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SUMMARY 


This  report  presents  the  results  of  a  study  which  develops  a 
rational  approach  for  evaluating  the  potential  of  a  helicopter 
transmission  for  on-condition  operation.  Integral  to  this 
study  is  the  presentation  of  the  mathematical  relationship 
between  component  operating  time  and  component  hazard  rate. 
Hazard  rate  is  che  value  that  a  component  hazard  function 
assumes  at  a  given  time,  t.  Hazard  function  is  the  mathe¬ 
matical  model  which  relates  a  conditional  instantaneous  fail¬ 
ure  rate  to  component  operating  time.  It  is  postulated  that 
the  component  hazard  function  is  the  crux  of  an  on-condition 
analysis  and  therefore  requires  rigorous  definition  and  quan¬ 
tification.  Various  methods  of  determining  hazard  functions 
were  evaluate  1,  and  a  conclusion  is  presented  defining  the 
most  powerful  of  these  techniques. 

An  evaluation  of  the  impact  of  on-condition  transmission 
operation  upon  reliability,  safety,  availability,  maintain¬ 
ability,  mission  reliability,  and  cost  was  developed. 

Detailed  analysis  of  transmission  test  and  overhaul  data  was 
performed  to  evaluate  the  hazard  functions  of  various  trans¬ 
mission  elemental  failure  modes.  The  result  of  this  analysis 
provides  a  baseline  for  determination  of  the  areas  most  sig¬ 
nificant  to  on-condition  transmission  operation.  A  further 
objective  of  this  analysis  was  the  identification  of  those 
transmission  elements  (components/parts)  requiring  appropri¬ 
ate  design  changes,  failure  warning  and  inspection  criteria, 
or  test  approaches,  and  the  development  of  criteria  for 
application  to  future  designs. 

The  conclusions  of  the  study  present  the  criteria  for  evalu¬ 
ating  the  potential  of  a  newly  designed  or  existing  helicopter 
transmission  for  on-condition  operation. 


FOREWORD 


This  report  covers  a  study  to  analyze  the  criteria  necessary 
to  evaluate  the  potential  for  on-condition  maintenance  of 
helicopter  transmissions,  conducted  under  Contract  DAAJ02-72- 
C-0068,  Task  1F162205A11902 ,  for  the  Eustis  Directoiate,  U.S. 

Army  Air  Mobility  Research  and  Development  Laboratory  (USAAMRDL) , 
Fort  Eustis,  Virginia. 

USAAMRDL  technical  direction  was  provided  by  Mr.  V.  Weiner  and 
Mr.  T.  House. 

The  principal  investigator  for  The  Boeing  Vertol  Company  was 
Mr.  J.  J.  Dougherty  III  of  Product  Assurance  Methodology,  who 
was  assisted  by  Messrs.  S.  J.  Blewitt  of  tne  same  department, 
r,.  b.  Board  of  R&M  Engineering,  and  personnel  from  Advanced  Drive 
Systems  Technology.  Program  management  and  technical  direc¬ 
tion  were  provided  by  Mr.  G.  W.  Windolph,  Director,  Product 
Assurance  and  GSE  Department,  and  Mr.  R.  B.  Aronson,  Unit 
Chief,  Product  Assurance  Methodology. 
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INTRODUCTION 


Historically,  high  levels  of  helicopter  transmission  mean  time 
between  removals  {MTBR)  have  not  been  achieved  until  the  air¬ 
craft  have  been  far  into  the  operational  portions  of  their  life 
cycles.  Even  then,  MTBR  levels  have  been  artificially  limited 
by  established  time-between-overhaul  (TBO)  intervals.  Further¬ 
more,  scheduled  overhaul  of  transmissions  contributes  a  signif¬ 
icant  amount  to  the  total  operating  cost  of  helicopters,  as 
shown  in  Figure  1. 

A  recent  Boeing-Vertol  study,  CAPABILITY  OF  CH-47C  FORWARD, 

AFT,  AND  COMBINING  GEARBOXES  FOR  ON-CONDITION  OPERATION1,  and 
the  related  paper,  A  CRITERION  FOR  ON-CONDITION  TRANSMISSIONS 
AND  ITS  APPLICATION  TO  THE  CH-47C2,  indicate  that  the  capabil¬ 
ity  for  transmission  cn-condition  operation  is  currently 
achievable.  Furthermore,  it  has  been  established  that  analy¬ 
sis  of  field  and  test  experience  can  be  used  to  substantiate 
this  capability.  If  transmissions  lack  true  on-condition 
capability,  the  same  analysis  of  test  and  field  data  can  deter¬ 
mine  the  correct  TBO  from  a  system  effectiveness  and  cost 
viewpoint. 

Criteria  and  analytical  methods  for  evaluation  of  product  com¬ 
pliance  with  an  on-condition  objective  must  be  established  so 
that  the  life-cycle  cost  and  effectiveness  benefits  of  extended 
MTBR ' s  can  be  achieved.  To  fulfill  this  requirement,  Boeing- 
Vertol  has  developed  and  documented  in  this  report  the 
following : 

o  Rigorous  detailed  methodology  for  examining  test  and  field 
data  from  operational  components  to  determine  or  to  estab¬ 
lish  appropriate  TBO  levels  or  the  capability  for  on- 
condition  operation. 

o  Design  and  test  criteria  which  permit  determination  of  the 
TBO  or  on-condition  capability  of  components  early  in  the 
system  life  cycle. 

This  was  accomplished  by  performing  the  tasks  described  in  the 
flov;  chart  in  Figure  2. 

The  result  of  this  study  is  that  a  rigorous,  clear  method  of 
identifying  the  capability  of  a  helicopter  transmission  for 
on-condition  operation  has  been  established  and  is  available 
for  use  where  none  existed  previously.  This  method  gives  the 
user  a  means  for  evaluating  the  potential  for  discontinuing 
costly  scheduled  overhauls  without  sacrificing  safety  and 
effectiveness,  or  establishing  the  TBO  interval  at  a  level 
where  it  will  be  most  effective. 


Figure  1.  CH-47A  Direct  Maintenance  Cost  Including  Field 
and  Depot  Labor  and  Material. 


Figure  2.  Flow  Chart  for  Analysis  of  Criteria  for 
On-Condition  Maintenance  of  Helicopter 


THE  CONCEPT  OF  ON-CONDITTON  OPERATION 


INTRODUCTION 

Essential  to  any  rigorous  discussion  of  on-condition  mainte¬ 
nance  is  the  definition  and  understanding  of  certain  basic 
terms,  some  of  which  may  appear  to  the  reader  to  be  self- 
explanatory.  Over  the  years,  some  of  these  terms  have  been 
used  improperly  and  the  meanings  have  become  distorted. 
Therefore,  to  avoid  confusion,  this  first  section  will  rigor 
ously  define  terms  for  subsequent  use  in  the  study. 


TIME  BETWEEN  OVERHAULS  (TBO) 

Time  between  overhauls  (TBO)  is  a  scheduled  operating  period 
after  which  an  item  is  mandatorily  overhauled.  The  key  word 
in  this  definition  is  scheduled.  It  is  a  numerical  value, 
typically  hours  of  operation,  established  by  a  manufacturer  of 
hardware  or  hardware  user  to  limit  the  duration  of  usage  of  a 
particular  part.  The  important  point  to  remember  is  that  the 
figure  is  an  established  one,  derived  for  various  reasons 
which  will  be  discussed.  TBO  is  not  the  average  time  on  com¬ 
ponents  which  have  been  overhauled;  that  is,  it  is  not  the 
total  number  of  hours  on  overhauled  parts  divided  by  the  num¬ 
ber  of  parts  overhauled. 

At  the  time  of  scheduled  overhaul  of  a  TBO  item,  various  com¬ 
ponents  of  the  item  are  replaced,  the  life  limits  of  which 
have  been  reached  or  will  be  reached  before  the  next  scheduled 
overhaul.  For  example,  a  transmission  scheduled  to  be  over¬ 
hauled  after  1,200  hours  of  operation  will  have  all  components 
replaced  whose  individual  life  limits  are  1,200  hours,  plus 
those  whose  life  limits  are  between  1,200  hours  and  2,400 
hours,  the  next  scheduled  time  of  overhaul.  Additionally, 
upon  inspection,  any  components  exhibiting  a  condition  which 
could  result  in  performance  degradation  are  replaced.  After 
scheduled  overhaul  the  component  is  considered  to  possess  the 
same  capabilities  and  performance  characteristics  which  it 
possessed  when  new. 

The  purposes  and  objectives  of  a  TBO  include:  reduction  of 
total  overhaul  costs,  attainment  of  high  aircraft  availability 
by  maintenance  scheduling,  and  detection  of  unanticipated  and 
otherwise  undetectable  failure  modes.  The  validity  of  these 
objectives  will  be  examined  in  detail  in  this  study. 


THE  BATHTUB  CURVE 

Integral  to  any  discussion  of  TBO  is  a  graphic  illustration 
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known  to  reliability  students  as  the  bathtub  curve.  As  shown 
in  Figure  3,  this  curve  depicts  one  of  the  assumptions  implied 
by  advocates  of  a  TBO;  that  is,  at  some  future  time  in  the 
life  of  a  component  the  undesirable  occurrence  of  an  increas¬ 
ing  rate  of  failure  will  take  place. 

The  bathtub  curve  in  reality  is  composed  of  three  curves,  re¬ 
presenting  three  stages  which  might  be  expected  to  occur  in 
the  life  time  of  a  part.  S.  R.  Calabro  states  the  following: 

"In  general,  a  device  goes  through  three  separate 
and  distinct  stages.  The  first  is  called  a  break- 
in  or  infant  stage,  during  which  the  equipment  is 
characterized  by  a  relatively  high  failure  rate. 

The  second  is  called  the  operating  stage,  during 
which  we  experience  a  constant  failure  rate.  This 
is  also  called  the  stable  or  operating  period. 

The  third  stage  is  called  the  wear-out  phase, 
which  is  the  time  when  the  frequency  of  failure, 
or  the  failure  rate,  increases  rapidly.  When  this 
happens  it  is  an  indication  that  the  equipment  has 
aged  or  become  worn."3 

Infant  Mortality 

There  arc  several  reasons  for  a  high  rate  of  failure  in  the 
early  stage  of  a  part  life  cycle.  Many  early  failures  result 
from  poor  manufacturing  techniques  during  the  production 
process  and  the  subsequent  appearance  of  those  substandard 
parts  which  were  missed  by  the  quality  control  program.  If  a 
certain  sampling  inspection  program  produces  results  such  that 
98  percent  of  all  parts  manufactured  are  up  to  standards,  then 
it  is  known  that  on  the  average  2  of  every  100  parts  will  be 
defective.  The  infant  mortality  portion  of  the  bathtub  curve 
illustrates  the  failure  and  replacement  of  these  parts.  The 
curve  slopes  downward  to  the  right  since  the  weak  specimens 
in  a  large  population  of  good  components,  being  replaced  by 
a  substantial  percentage  of  good  components  when  they  fail, 
die  out  very  fast.  Theoretically,  early  failures  should  be 
quickly  eliminated;  however,  they  can  occur  every  time  a  piece 
of  equipment  is  overhauled  or  repaired,  either  by  improper  se¬ 
lection  of  replacement  components  or  by  improper  installation 
and  other  maintenance  errors.  As  components  are  in  service 
longer,  maintenance-induced  failures  tend  to  decrease.  Addi¬ 
tionally,  items  may  be  replaced  due  to  contamination  from 
systems  external  to  the  component;  yet,  due  to  incomplete 
flushing  of  the  external  system,  the  replacement  part  fails 
after  only  a  few  hours  of  operation  since  it  too  becomes 
contaminated. 

Early  failures  can  be  eliminated  by  the  so-called  debugging 
or  burn-in  process,  whereby  a  part  is  operated  for  a  number  of 
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♦THIS  IS  THE  INSTANTANEOUS  FAILURE  RATE  OF  A  COMPONENT  AT 
ANY  TIME  GIVEN  THAT  IT  HAS  BEEN  OPERATED  UP  TO  THAT  TIME. 


Figure  3.  The  Bathtub  Curve. 
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hours  before  entering  actual  service.  Estimates  of  this 
period  range  up  to  200  hours,  depending  on  the  equipment. 

Constant  Failure  Rate 

The  second  stage  of  the  component  life  cycle  appearing  cn  the 
bathtub  curve  is  characterized  by  a  constant  failure  rate.  A 
constant  failure  rate  is  produced  by  random  failures  of  vari¬ 
ous  modes,  occurring  on  different  components  of  an  assembly, 
which  when  combined  result  in  a  failure  rate  that  neither  in¬ 
creases  nor  decreases.  The  important  point  to  remember  about 
a  constant  failure  rate  is  that  the  failures  occur  independ¬ 
ently  of  time,  irregularly  and  unexpectedly.  Chance  failures 
can  be  caused  by  sudden  stress  accumulations  beyond  the  design 
strength  of  the  component,  and  neither  good  debugging  tech¬ 
niques  nor  the  best  maintenance  techniques  can  eliminate  them. 
Also,  random  failures  cannot  be  prevented  by  a  replacement 
policy,  since,  at  best,  the  replacement  components  have  the 
same  characteristic  as  had  the  removed  components.  Replace¬ 
ment  of  good  nonfailed  components  at  fixed  intervals  would 
improve  nothing,  and  could  do  harm,  since  the  reintroduction 
of  infant  mortality  would  increase  the  overall  assembly  fail¬ 
ure  rate. 

Wearout 

The  third  stage  of  an  assembly  life  cycle,  which  is  illus¬ 
trated  on  the  bathtub  curve  by  an  upward  slope  after  a  period 
of  constant  failure  rate,  is  the  phase  which  results  in  an 
increase  in  the  failure  rate  with  increasing  age  or  operating 
hours.  These  are  failures  whicn  may  be  predictable  on  the 
basis  -of  known  characteristics  and  which  therefore  can  be 
avoided  by  means  of  preventive  maintenance.  The  ages  at  which 
wearout  occurs  differ  widely  and  are  a  function  of  component 
design.  Most  wearout  modes  are  detectable  during  operation 
of  the  system. 


HAZARD  FUNCTION 

The  general  term  for  the  figure  }ust  described  as  the  bathtub 
curve  is  hazard  function.  It  describes  how  the  failure  rate 
of  a  given  unit  changes  as  its  operating  time  increases.  The 
important  point  to  remember  is  that  it  is  a  conditional  ex¬ 
pression;  that  is,  if  the  component  reaches  a  certain  operat¬ 
ing  time  it  will  have  the  indicated  failure  rate. 

The  figure  is  therefore  very  appropriate  to  the  issue  of  TBO 
placement.  The  alternatives  at  any  given  point  in  time  are 
either  to  impose  a  TBO  and  cause  the  removal  of  the  component 
from  service,  or  allow  it  to  continue  to  operate  and  be  ex¬ 
posed  to  its  future  failure  rate. 


It  is  possible  for  there  to  be  more  than  one  hazard  function 
for  a  component/  each  describing  a  different  failure  conse¬ 
quence.  The  most  serious  consequence  is  the  complete  inabil¬ 
ity  to  perform  the  assigned  function.  Other  less  serious 
failures  can  be  grouped  into  distinct  categories,  each  with 
its  own  hazard  function,  which  differ  in  magnitude  and  shape. 
For  example,  a  transmission  in  a  helicopter  with  its  different 
hazard  functions  could  appear  as  Figure  4. 

The  three  hazard  functions  illustrated  could  each  be  used  to 
determine  a  different,  but  proper,  location  for  placement  of 
the  TBO  interval,  depending  on  the  desired  objectives.  On  the 
surface  it  would  seem  to  be  a  simple  matter  to  decide  at  which 
point  the  TBO  interval  should  be  established;  that  is,  remov¬ 
als  should  take  place  at  the  point  where  the  failure  rate  be¬ 
gins  to  increase.  However,  after  safety  considerations  have 
been  made,  it  is  essential  to  determine  whether  or  not  re¬ 
moving  and  repairing  the  components  which  will  fail  due  to 
the  increasing  hazard  function  will  be  more  or  less  expensive 
than  overhauling  all  components  at  a  certain  interval.  The 
hazard  function  is  integral  to  any  process  involving  a  TBO 
versus  on-condition  decision. 


WEIBULL  DISTRIBUTION 

For  years  the  assumption  that  failure  rate  remains  constant 
with  respect  to  time  (exponential  distribution)  was  accepted, 
allowing  the  engineer  to  make  the  single-point  estimate  of 
reliability,  which  is  known  as  mean  time  between  failures 
(MTBF) .  More  recently,  however,  the  realization  that  failure 
rates  do,  in  fact,  change  with  time  has  led  to  the  evaluation 
of  other  dist  ibutions,  notably  the  normal,  log  normal,  beta, 
and  Weibull  distributions. 

The  Weibull  distribution  has  been  found  to  be  most  powerful 
in  the  analysis  of  failure  data — primarily  because  the  Weibull 
distribution  is  an  excellent  approximation  for  all  the  previ¬ 
ously  mentioned  distributions. 

The  two-parameter  Weibull  distribution  is  completely  defined 
over  all  values  of  time,  t,  by  the  estimation  of  the  param¬ 
eters  8  (beta)  and  9  (theta)  . 

8  is  the  Weibull  shape  parameter.  It  is  indicative  of  the 
manner  in  which  the  probability  is  distributed  in  relation  to 
time.  As  the  following  plots  show,  8=1  represents  a  constant 
hazard  function,  S<1  represents  a  decreasing  hazard  function 
(infant  mortality) ,  and  8>1  represents  an  increasing  hazard 
function  (wearout) . 
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0  is  the  Weibull  scale  parameter.  It  is  inversely  indicative 
of  the  height  of  the  hazard  function — that  is,  for  the  same 
8,  if  02  is  greater  than  0i,  then  H(t)2  is  less  than  H(t)i. 
Physically  0  is  equal  to  the  time  at  which  the  cumulative 
probability  of  failure  is  equal  to  63  percent.  It  is  of  value 
to  note,  that  for  8=1,  the  Weibull  distribution  is  identical 
to  the  exponential  distribution  with  6=MTBF. 

Some  of  the  different  forms  in  which  a  Weibull  distribution 
can  be  expressed  are: 

f(t)  = Probability  Density  Function  (PDF)  = 8/6 (t/0) ^“^e“ (t/9)^ 


PDF  is  an  expression  of  pro¬ 
pensity  toward  failure  versus 
a  discrete  time  t.  Dimen¬ 
sions  of  f(t)  are  relative 
and  should  not  be  miscon¬ 
strued  as  probabilities. 


CDF  is  an  expression  of  prob 
ability  of  failure  prior  to 
time  t. 


H(t)  =  Hazard  Function  =  f- 


PDF 

CDF 


H ( t )  is  an  expression  of  pro¬ 
pensity  toward  failure  at 
time  t  +  E  (where  E  -*•  o)  , 
given  that  a  component  has 
successfully  operated  to  time 
t. 


The  following  discussion  presents  one  simple  manner  of  esti¬ 
mating  the  parameters  (8,0)  necessary  for  defining  a  Weibull 
distribution.  This  graphical  method  enables  the  engineer  to 
make  quick  and  accurate  estimates  of  the  parameters  by  plot¬ 
ting  the  failure  points  on  Weibull  paper.  Once  the  estimates 
of  8  and  0  are  obtained,  the  ultimate  goal  of  hazard  function 
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display  can  be  achieved  by  calculating  the  hazard  rate  for 
varying  times  t.  (See  Figure  5  for  an  example  of  Weibull 
paper. ) 

3  is  determined  by  erecting  a  line  perpendicular  to  the 
plotted  line  and  passing  through  the  estimation  point.  3  is 
then  read  off  the  3  scale. 

0  in  hours  is  determined  by  where  the  plotted  line  intersects 
the  63-percent  cumulative  failure  line.  This  is  the  dashed 
horizontal  line  with  the  0  in  the  margins. 

In  plotting  data  on  this  paper,  the  following  procedure  is 
performed: 

1.  Arrange  all  data  in  order  of  ascending  component 
operating  hours. 

mt' 

2.  R(t')  =  -  -  , 

n  -  St 

where  mt'  =  number  of  failures  up  to  and  including 
time  t' . 

Sf-'  =  number  of  scheduled  removals  prior  to 
time  t ' . 

n  =  number  of  observations,  both  scheduled 
removals  and  failures,  in  the  data  set. 

3.  Plot  the  points  ( t * ,  R(t'))  for  all  values  of  t1  at 
which  failures  have  occurred. 

4.  Estimate  3,  0  employing  the  method  previously  discussed. 


ON-CONDITION  MAINTENANCE 


On-condition  maintenance  is  the  practice  whereby  repair  or 
overhaul  is  performed  only  on  items  exhibiting  performance 
degradation,  as  opposed  to  having  all  items  overhauled  at 
specifically  established  intervals.  The  item  under  consider¬ 
ation  remains  installed  and  is  used  until  a  failure  occurs  or 
until  a  diagnostic  system  or  inspection  indicates  a  degrading 
performance  situation  or  an  incipient  failure.  At  this  time, 
the  item  is  removed,  disassembled,  and  the  defective  component 
replaced.  During  disassembly,  any  other  component  whose  condi¬ 
tion  indicates  that  it  would  impair  the  ability  of  the  item  to 
perform  properly  is  also  replaced. 

It  should  be  noted  here  that  all  components  are  maintained 
under  a  mitigated  form  of  on-condition  operation.  That  is,  all 
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Figure  5.  Form  for  Presentation  of  Weibull  Distribution 


components  are  on-conditio;i  up  to  their  TBO  points  since  they 
are  only  removed  after  detection  of  a  failure  or  incipient 
failure  mecnanism. 

There  are  at  least  two  objectives  to  be  considered  in  the 
establishment  of  an  on-condition  maintenance  philosophy.  The 
first  is  that  the  removal  of  the  TBO  interval  should  result  in 
a  decrease  or,  at  least,  no  increase  in  the  number  of  failures 
which  could  possibly  cause  an  accident.  This  is  most  impor- 
t  int  since  increased  risk  in  this  area  can  never  be  offset  by 
increased  cost  effectiveness,  which  is  the  second  objective  of 
on-condition  maintenance.  Removal  of  the  TBO  interval  should 
result  in  an  increase  or,  at  least,  no  decrease  in  cost  effec¬ 
tiveness  where  cost  effectiveness  is  a  function  of  availabil¬ 
ity,  mission  reliability,  and  operating  costs.  These  costs 
include  the  expense  of  removal  and  replacement  of  units  and 
the  subsequent  repair  and  overhaul  costs  of  the  removed 
components . 

Designing  components  for  on-condition  operation  requires  that 
careful  attention  be  paid  to  preventing  the  presence  of  fail¬ 
ure  modes  having  a  potentially  catastrophic  failure  progres¬ 
sion  or  having  increasing  failure  rates,  which  might  justify 
placement  of  a  TBO  interval.  Where  catastrophic  modes  are  un¬ 
avoidable  on -condition  operation  can  be  achieved  by  ensuring 
that  adequate  failure  warning  and  inspection  devices  are  pro¬ 
vided  to  reduce  potentially  catastrophic  modes  to  a  merely 
maintenance  affecting  consequence.  These  issues  will  be  ex¬ 
amined  and  their  relative  effects  discussed  in  later  sections 
of  this  study. 

MTB'JR,  MTBR 

One  of  the  standard  measurements  of  component  reliability  is 
the  mean  time  between  unscheduled  removals  (MTBUR) ,  MTBUR 
pertains  to  failures  which  result  in  the  removal  of  the  par¬ 
ticular  item  from  the  aircraft;  for  major  helicopter  dynamic 
components,  the  term  can  be  equated  with  mean  time  between 
failures  (MTBF)  since  these  items,  when  failed,  can  almost 
never  be  repaired  without  being  removed  from  the  aircraft. 
MTBUR  can  be  defined  as  the  average  value  of  operating  time 
between  removals  of  failed  items.  It  is  the  ratio  of  the 
total  operating  time  on  all  components  to  the  total  number  of 
unscheduled  removals .  The  equation  to  calculate  MTBUR  is 
simply 


MTBUR  = 


Accumulated  time  on  all  items 
Total  items  removed  for  failure 


In  the  case  of  a  constant  failure  ra/te  (the  flat  portion  of 
the  bathtub  curve) ,  the  MTBUR  is  the  reciprocal  of  the  failure 
rate.  / 
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On  the  other  hand,  mean  time  between  removals  (MTBR)  considers 
both  the  unscheduled  removals  due  to  failure  and  the  scheduled 
removals  for  preventive  maintenance  (TBO-cauoed  removals) . 

The  value  of  MTBR  is  inherently  limited  by  the  inclusion  of 
scheduled  removals  in  the  data  base  and  can  never  be  greater 
than  the  TBO  value.  MTBR  is  defined  as  the  average  value  of 
operating  time  between  all  removals  of  components  for  both 
scheduled  and  unscheduled  reasons.  It  is  calculated  in  the 
same  manner  as  MTBUR  with  the  inclusion  of  scheduled  removals 
in  the  denominator.  Alternatively,  if  there  is  a  constant 
failure  rate  and  if  the  MTBUR  and  TBO  interval  are  known,  one 
can  calculate  MTBR  using  the  following  equation: 


MTBR  =  [1  -  e(~TB0/M1'BUR)  ]  •  MTBUR 
Summary  of  On-Condition  Concepts  (Figure  6  ) 

A  decision  to  implement  an  on-condition  maintenance  philosophy 
is  based  on  considerations  of  cost,  mission  effectiveness  and 
safety.  When  compared  with  operating  with  a  TBO,  on-condition 
must  be  less  expensive  with  little  or  no  degradation  of  mission 
effectiveness,  nor  an  increase  in  the  accident  rate.  Figure  6 
presents  a  brief  comparison  of  on-condition  versus  TBO,  and 
summarizes  the  concepts  leading  to  a  decision  for  on-condition 
maintenance.  Operating  on-condition  may  lead  to  a  change  in 
the  hazard  rate  at  some  future  time.  Imposition  of  a  TBO 
stops  the  hazard  function  from  changing  but  generates  mainte¬ 
nance  cost  increases  at  the  time  of  overhaul.  The  problem 
then  is  Uo  reduce  costs  by  elimination  of  the  TBO,  without  in¬ 
curring  the  mission  and/or  safety  risks  of  an  increasing 
hazard  rate. 

Generally,  failure  warning  and  inspection  systems  reduce  all 
three  hazard  functions:  maintenance,  mission  abort  and  safety. 
The  maintenance  malfunction  hazard  rate  is  reduced  by  eliminat¬ 
ing  unnecessary  removals;  the  mission  abort  rate  is  reduced  due 
to  improvements  in  ground  maintenance  detection  of  actual  or 
incipient  mission  affecting  failures;  and  the  flight  safety 
failure  rate  is  reduced  by  providing  sufficient  pilot  warning 
for  accident  avoidance.  When  failure  warning  and  inspection 
systems  are  combined  with  sound  design  and  redesign  practices, 
along  with  a  solid  test  program,  the  mission  abort  and  safety 
hazard  functions  can  be  changed  in  shape  and  magnitude  to  the 
point  where  on-condition  maintenance  becomes  more  desirable 
than  a  TBO.  The  role  of  design  and  testing,  specifically  for 
an  on-condition  objective,  is  to  act  in  concert  with  diagnos¬ 
tics  to  eliminate  the  increasing  hazard  rates.  It  is  not 
necessary  that  the  maintenance  malfunction  hazard  function 
for  on-condition  be  lower  than  the  average  hazard  function  for 
TBO,  because  on-condition  maintenance  invariably  tends  to  be 
more  cost-effective  than  a  TBO  due  to  the  high  costs  involved 
in  scheduled  overhaul. 
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RELATION  OF  ON-CONDITION  OPERATION  TO  RELIABILITY, 
SAFETY,  MAINTAINABILITY,  AVAILABILITY,  AND  COST 


INTRODUCTION 

The  intent  of  this  section  is  to  qualitatively  identify  the 
relationship  between  on-condition  operation  and  reliability, 
safety,  maintainability,  availability,  and  cost. 

Due  to  the  inherent  relationships  between  on-condition  opera¬ 
tion  and  these  parameters,  this  can  be  done  for  each  parameter 
independently,  in  those  cases  when  the  hazard  function  is 
decreasing  or  constant.  Thus,  this  section  draws  conclusions 
about  the  value  of  on-condition  operation  for  these  situations. 

Furthermore,  this  section  identifies  these  areas  (namely,  the 
cases  of  increasing  hazard  functions)  when  the  effect  of  on- 
condition  is  indeterminate  without  rigorous  mathematical 
treatment. 

The  methods  for  quantitatively  evaluating  the  effect  of  on- 
condition  operation  upon  these  parameters,  both  independently 
and  interactively,  are  developed  in  Appendix  I. 

Appendix  I  will  also  qualitatively  introduce  the  more  complex 
issue  of  the  effect  of  having  different  hazard  functions  over 
different  segments  of  a  component's  lift  (as  in  the  case  with 
the  bathtub  curve) . 

SUMMARY 

As  stated  previously,  the  hazard  function  is  the  mathematical 
expression  around  which  the  formulation  of  on-condition  cri¬ 
teria  takes  place.  Table  I  summarizes  the  effect  of  the 
various  types  of  simple  hazard  functions  upon  product  assur¬ 
ance  parameters.  From  this  table,  it  should  be  apparent  that 
in  the  case  of  a  decreasing  or  constant  hazard  function,  on- 
condition  is  beneficial  from  the  aspect  of  every  parameter 
considered.  For  an  increasing  hazard  function,  the  impact  of 
eliminating  the  TBO  upon  several  areas  (notably  unscheduled 
MMH/FH,  availability,  and  cost)  requires  unique  assessment. 

That  is,  for  these  cases,  generalities  of  the  form  postulated 
for  decreasing  or  constant  hazard  functions  are  meaningless. 

The  following  pages  of  this  section  discuss  in  greater  detail 
the  rationale  which  formulated  the  conclusions  of  Table  I. 

In  reading  this  section  it  should  be  remembered  that  components 
are  now,  in  fact,  operating  on-condition  up  to  their  TBO  values, 
and  that  when  we  speak,  in  the  context  of  this  report,  of 
operating  on-condition,  we  are  merely  postulating  the  extrap¬ 
olation  of  a  previously  existing  maintenance  philosophy. 
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TABLE  I.  EFFECT  OF  ELIMINATING  TBO  UPON  RELIABILITY , 
SAFETY,  MAINTAINABILITY,  AVAILABILITY,  AND 
COST 


Hazard,, 

Function, 

Class 

Parameter 

Decreasing 

Constant 

Increasing 

MTBUR 

Improves 

Unchanged 

Degrades 

MTBR 

Improves 

Improves 

Improves 

MTTR  (Organizational) 

Independent 

Independent 

Independent 

Unscheduled  MMH/FH 
(Organizational) 

Improves 

Improves 

Indeterminate* 

Safety 

Improves 

Unchanged 

Degrades 

Availability 

(Inherent) 

Improves 

Unchanged 

Degrades 

Availability 

(Operational) 

Improves 

Improves 

Indeterminate* 

Availability  (Ach.) 

Improves 

Improves 

Improves 

Overhaul  Costs 

Improve 

Improve 

Indeterminate* 

♦Evaluation  of  the  effect  of  an  increasing  hazard  function 
upon  this  parameter,  when  eliminating  TBO,  must  be  made  using 
the  methods  developed  in  Appendix  I . 


RELIABILITY 


The  previous  discussion  dealt  exclusively  with  component 
hazard  function  as  the  important  indication  of  a  system's 
capability  for  on-condition  operation.  Although  the  hazard 
function  display  lends  itself  to  an  evaluation  of  proper 
position  for  TBO,  it  is  not  directly  indicative  of  component 
reliability.  Hazard  rate  is  the  instantaneous  failure  rate 
of  a  component  at  time  T,  conditional  upon  its  successfully 
operating  up  to  time  T;  reliability,  however,  is  a  cumulative 
function.  A  widely  accepted  definition  is: 

"Reliability  is  the  probability  of  a  device  per¬ 
forming  its  purpose  adequately  for  the  period  of 
time  intended  under  the  operating  conditions 
encountered. " 5 
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The  critical  phrase  differentiating  reliability  from  hazard 
function  is  "...period  of  time  intended  ...."  Generally  the 
period  of  time  extends  from  time  zero  to  some  time  T.  Thus 
when  we  say  that  a  component  has  90-percent  reliability  at 
600  hours,  we  mean  that  the  probability  the  component  will 
successfully  operate  between  zero  and  600  hours  is  90  percent. 
It  should  be  remembered  that  reliability  is  a  nonincreasing 
function.  That  is,  if  a  component  had  90-percent  reliability 
of  successfully  operating  to  600  hours,  its  reliability  at 
1,200  hours  cannot  be  greater  than  90  percent.  Figure  7  dis¬ 
plays  typical  reliability  plots  for  components  having  decreas¬ 
ing,  constant,  and  increasing  failure  rates. 

As  displayed  in  this  figure,  all  three  components  have  90- 
percent  reliability  at  600  hours;  at  1,200  hours  the  component 
with  a  decreasing  failure  rate  has  87-percent  reliability,  the 
component  with  the  constant  rate  has  81-percent  reliability, 
and  the  component  with  the  increasing  rate  has  50-percent  re¬ 
liability.  From  these  figures  the  following  example  will 
identify  in  which  case  a  600-hour  versus  1,200-hour  TBO  would 
be  beneficial. 

Let  us  assume  that  the  intended  period  of  time  for  operating 
an  aircraft  is  1,200  hours.  For  the  three  reliability  func¬ 
tions  plotted  on  the  previous  figure  the  following  probabil¬ 
ities  of  successfully  operating  1,200  hours  would  be  expected. 


Probability  of  0  Probability  of  0 

Failures  in  1,200  Hours  Failures  in  1,200  Hours 


With  600-Hour  TBO 

With  1,200-Hour  TBO 

Decreasing 

0.81 

0.87 

Constant 

0.81 

0.81 

Increasing 

0.81 

0.50 

Thus  it  would  appear  that,  in  the  case  of  a  decreasing  or  con¬ 
stant  failure  rate,  reliability  may  not  decrease  with  an 
increase  in  TBO,  but  actually  may,  as  in  the  case  of  the  de¬ 
creasing  failure  rate,  increase. 

Thus  we  will  find  that  components  with  constant  or  decreasing 
failure  rates  will  incur  no  detrimental  effects  in  terms  of 
reliability  from  on-condition  operation.  Those  ^..nibiting  an 
increasing  failure  rate  will  generally  suffer  a  decrease  in 
reliability  due  to  on-condition  operation. 

For  those  components  having  complex  failure  rates  (e.g., 

DCI  -  decreasing,  constant,  increasing)  an  evaluation  must  be 
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made  case  by  case.  Generalizations  for  these  cases  are 
impractical. 

The  tools  by  which  these  complex  cases  can  be  evaluated  will 
be  developed  in  Appendix  I. 


SAFETY 


In  an  evaluation  of  the  criteria  for  TBO  extension  or  removal, 
the  issue  of  safety  is  the  dominant  concern.  Safety,  however, 
poses  two  perplexing  points.  First,  any  discussion  of  safety 
has  a  tendency  to  deteriorate  to  an  emotional  rather  than 
analytical  discourse.  Second,  it  is  an  unfortunate  fact  that 
safety  is  difficult  to  quantify  as  rigorously  as  reliability 
or  cost.  This  is  due  to  the  relatively  few  accidents  caused 
by  helicopter  transmissions. 

In  the  context  of  this  study,  safety  will  be  considered  the 
most  important  reason  for  TBO  establishment.  If  a  transmis¬ 
sion  is  not  considered  safe  to  operate  on-condition,  any 
mission  accomplishment  or  cost  payoffs  are  irrelevant.  The 
mathematical  models  for  evaluating  the  optimum  position  for 
TBO  will  be  developed  in  Appendix  I.  For  the  reasons  just 
stated,  it  is  not  necessary  that  safety  be  evaluated  inter¬ 
actively  with  the  other  parameters  under  consideration. 


MAINTENANCE  BURDEN 

Maintenance  burden  is  one  of  the  areas  where  a  payoff  is 
expected  from  on-condition  operation. 

In  the  case  of  a  decreasing  hazard  function,  the  expected 
number  of  failures  over  time  for  an  on-condition  transmission 
will  be  less  than  with  a  TBO,  due  to  the  fact  that  the  on- 
condition  items  are  not  resubjected  to  the  infant  mortality 
phase.  This  is  illustrated  in  Figure  8. 

With  a  constant  failure  rate,  the  expected  number  of  failures 
is  the  same  for  items  operating  either  on-condition  or  with  a 
TBO,  due  to  the  random  occurrence  of  failures.  Assuming  that 
the  mean  time  to  repair  an  item  (MTTR)  remains  the  same  for 
both  maintenance  philosophies,  the  following  conclusions  be¬ 
come  apparent  regarding  maintainability  of  items  with  constant 
or  decreasing  failure  rates.  Since  MTBR  and  MTBUR  for  an  item 
operating  on-condition  will  be  greater  than  or  equal  to  that 
exhibited  by  the  same  item  when  operating  with  a  TBO,  unsched¬ 
uled  downtime,  total  downtime,  and  maintenance  manhours  per 
flight  hour  for  on-condition  items  will  be  less  tha  i  or  equal 
to  that  exhibited  by  the  same  items  operating  with  a  TBO. 
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In  the  case  of  an  increasing  hazard  function,  the  MTBUR  on- 
condition  may  be  lower  than  with  a  TBO.  However,  the  MTBR 
on-condition  must  be  higher  than  the  MTBR  with  a  TBO;  and 
consequently,  the  total  downtime/flight  hour  and  maintenance 
man-hou.rs/f light  hour  will  be  reduced.  Thus,  there  is  still  a 
potential  maintainability  payoff  due  to  the  elimination  of  the 
scheduled  removals  necessitated  by  a  TBO. 

Determination  of  whether  or  not  on-condition  operation  pro¬ 
vides  a  maintainability  benefit  for  those  components  having 
increasing  hazard  functions  must  be  made  on  a  case-by-case 
basis.  The  mathematical  model  to  perform  these  analyses  will 
be  developed  in  Appendix  I. 


AVAILABILITY 

As  was  previously  discussed  in  this  section,  the  total  mainte¬ 
nance  dowtime  per  flight  hour  is  reduced  through  on-condition 
operation  if  the  item  has  a  constant  or  decreasing  hazard 
function.  Furthermore,  for  items  with  hazard  functions  in 
this  category  (namely,  constant  or  decreasing) ,  a  reduction  in 
not-operationally-ready-supply  (NORS)  can  be  expected  due  to 
the  increase  in  MTBUR  and  MTBR  associated  with  on-condition 
operation.  That  is,  since  the  MTBUR  and  MTBR  increase  (or  at 
least  remain  the  same) ,  the  quantity  of  spares  and  probability 
of  requiring  spares  decreases.  Thus,  NORS  will  be  reduced  by 
on-condition  operation  and  availability  will  be  increased, 
since 

Availability  =  1.0  -  (NORS  +  NORM) 

Another  generally  accepted  definition  of  availability  that  can 
be  used  to  demonstrate  the  payoff  expected  from  on-condition 
operation  is  presented  by  Reference  6,  page  15: 


Inherent  Availability  =  MTBF  +  mttr 

Thus  it  should  be  obvious  that  for  constant  MTTR,  as  MTBF 
(which  is  equal  to  MTBUR  here)  increases,  inherent  availabil¬ 
ity  increases. 

A  second  form  of  availability  defined  in  Reference  6,  page 
150,  is: 


Operational  Availability  =  -• 


MTBF 


MTBF  +  Mean  Downtime (MDT) 


Since  total  downtime  per  flight  hour  for  transmissions  with 
decreasing  or  constant  hazard  functions  will  decrease  or  at 
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least  remain  constant,  similarly  the  MDT  will  not  increase  and 
the  operational  availability  will  increase. 

An  additional  definition  of  availability  which  one  may  en¬ 
counter  is: 


Achieved  Availability  =  ^tFr  +~MDT 

It  should  be  noted  that  MDT  includes  both  scheduled  and  un¬ 
scheduled  maintenance  and  that  sane  removals  occur  as  a  part 
of  or  during  scheduled  maintenance,  making  it  possible  for  a 
removal  to  occur  without  the  aircraft  being  charged  with  down¬ 
time  against  that  removal.  Employing  inherent  availability 
eliminates  the  problem  of  whether  or  not  scheduled  removals 
cause  aircraft  downtime.  Furthermore,  it  seems  apparent  that 
inherent  availability  is  a  more  conservative  measure  to  be 
used  in  evaluating  on-condition  potential,  since  the  on- 
condition  transmission  does  not  derive  any  benefit  from  a  lack 
of  scheduled  removals.  In  other  words  the  on-condition  trans¬ 
mission  is  compared  with  the  TBO  unit  on  the  basis  of  failure 
rate  and  not  the  artificial  restraint  of  TBO. 

For  transmissions  in  the  class  of  increasing  hazard  functions, 
a  case-by-case  evaluation  of  the  sensitivity  of  availability 
to  on-condition  operation  must  be  performed.  The  mathematical 
models  required  to  perform  this  analysis  will  be  developed  in 
Appendix  I. 


COST 


For  those  components  in  the  constant  failure  rate  class,  a  TBO 
is  never  cost-effective  since  the  number  of  failures  generated 
by  a  population  of  components  with  a  constant  failure  rate  is 
a  function  of  fleet  operating  hours,  not  time  on  individual 
parts.  That  is,  in  X  hours  of  fleet  operation,  X  divided  by 
MTBUR  yields  the  number  of  transmission  failures  that  can  be 
expected. 

For  a  TBO  to  be  beneficial  to  life-cycle  cost,  the  following 
inequality  must  hold: 

LCCtb0  <  LCC0<Cu 

where  LCC„,Dr.  =  life-cycle  cost  of  operation  with 
TB0  a  TBO 

LCCn  p  -  life-cycle  cost  of  operation  on 
’  *  condition 
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Now  in  the  case  of  a  constant  failure  rate 


LCC„,„^  =  — - 

TBO  MTBUR 


(Unscheduled  Cost) 


X  •  R(TBO) 

+  MTBUR  (r(TB07T  ’ 


(Scheduled  Cost) 


Proof : 


MTBR  =  MTBUR  (1  -  e“TB°/MTBUR) 


Number  of  removals 
in  X  hours 


X 


MTBR 

X 


MTBUR  (1  -  e"TB°/MTBUR) 

X _ _ 

MTBUR-MTBUR  (e-TB°/MTBUR7 

Now  the  expected  number  of  unscheduled  removals  is: 

X/MTBUR 

The  number  of  scheduled  removals  is: 


X _ X 

MTBUR  -  MTBUR  •  (e (“TBO/MTBUR)  )  MTBUR 

=  X _ (J_ 

MTBUR  V  -L.g-CTBO/MTBUR) 

=  X _ 

MTBUR  ^  R  (TBO) 

_  X _ fl  -  R  (TBO)  N 

MTBUR  V  R  (TBO)  / 

_  X _  .  R  (TBO) 

MTBUR  R  (TBO) 


where  R  =  reliability  and 

R  =  cumulative  probability  of  failure 


Thus ,  LCC 


X 


TBO 


MTBUR 


(Unscheduled  Cost) 


+  (Scheduled  Cost) 

MTBUR  R (TBO) 
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Now,  the  LCCq  c  =  •  (Unscheduled  Cost) 

since  there  is  no  TBO. 

Thus,  the  inequality 


LCCtbo  <  LCC0-Ci 


becomes 


X 

MTBUR 


(Unscheduled  Cost)  + 


X  •  R (TBO) 
MTBUR  R (TBO) 


<  — * — 
MTBUR 


(Unscheduled  Cost) 


(Scheduled  Cost) 


or 

X  •  R(TBO) 

MTBUR" .“FfTBoT  '  tSchedulea  Cost>  <  0 

Since  X,  R(TBO) ,  R(TBO) ,  and  MTBUR  are  all  positive  values, 
this  relationship  is  never  fulfilled. 

Therefore,  a  TBO  is  never  profitable  for  components  with  con¬ 
stant  hazard  functions. 

Similarly,  components  of  the  class  of  decreasing  hazard  func¬ 
tions  will  always  operate  more  cost  effectively  on  condition 
than  with  a  TBO. 

Proof : 


(!) 


TBO  „ 

MTBFTBO  “  l  (|)  6 


MTBF0.C.  *  /  (|)B  8 


_  (|)  “  , 

=  0  '  ( 1  +  i) 


and  for  0  <  1 


TBO 

/  (!) 

0 


(t)  8  .  6  .  e"  °  <  0  v  (1  +  h 
0  0 


The  above  inequality  cannot  be  demonstrated  using  closed- 
form  mathematical  techniques.  However,  in  order  to  demonstrate 
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the  validity  of  the  inequality,  Figure  9  has  been  developed 
using  numerical  integration  to  solve  the  finite  integral. 

For  transmissions  in  the  class  of  increasing  hazard  functions, 
a  case-by-case  analysis  must  be  performed  to  determine  the 
cost  effectiveness  of  on-condition  operation.  The  mathemat¬ 
ical  model  required  to  do  this  analysis  will  be  developed  in 
Appendix  I . 


HAZARD  FUNCTION  VARIATIONS 


The  previous  discussions  dealt  solely  with  monotonic  hazard 
functions  that  are  always  decreasing,  always  constant,  or 
always  increasing.  However,  all  three  classes  of  hazard  func¬ 
tions  (decreasing,  constant,  and  increasing)  may  be  present  in 
the  same  transmission  over  different  operating  time  periods. 
This  is  the  case  for  those  transmissions  whose  hazard  func¬ 
tions  follow  the  traditional  bathtub  curve  (Figure  3) . 

Inclusion  of  all  possible  permutations  and  combinations  of  the 
three  classes  of  hazard  functions  (without  class  repetition) 
yields  35  possible  assembly  hazard  functions.  Each  of  these 
combinations  has  been  coded  and  sketched  in  Figure  10  to  rein¬ 
force  the  concept  of  hazard  functions  and  to  provide  an  easy 
reference  for  future  discussions.  The  notation  D,  C,  or  I  has 
been  employed  to  signify  decreasing,  constant,  or  increasing. 
Thus,  the  code  DCI  has  been  employed  to  represent  the  bathtub 
curve  (sketch  10)  . 

Obviously,  a  representation  of  this  type  could  be  carried  on 
indefinitely  with  hypothetical  transmission  hazard  functions 
combining  four  or  more  different  types  of  hazard  functions 
theoretically  possible.  However,  experience  shows  that  most 
transmissions  fall  into  classes  1  through  15,  thus  obviating 
the  necessity  for  more  complex  variations. 


RELATION  OF  HAZARD  FUNCTION  TO  ON-CONDITION/TBO 


The  majority  of  transmission  hazard  functions  actually  fall 
into  one  of  the  following  classes:  D,  C,  I,  DC  ,  DI ,  Cl,  DCI 
(Figure  10,  sketches  1  through  6,  10). 

A  discussion  of  the  potential  of  these  seven  hazard  functions 
for  on-condition  operation  can  now  be  initiated.  The  hazard 
function  after  overhaul  is  assumed  to  be  reset  to  the  shape  it 
had  at  time  zero.  Thus,  classes  D,  C,  and  DC  present  no  po- 
(''ntial  for  TBO  placement  since  they  are  either  constant  or 
decreasing  hazard  functions;  and,  as  previously  stated,  the 
only  valid  basis  for  TBO  placement  is  to  preclude  the  undesir¬ 
able  event  of  increasing  hazard  function.  Thus  components 
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having  hazard  functions  of  the  form  of  D,  C,  and  DC  are  excel¬ 
lent  candidates  for  on-condition  operation. 

Classes  I,  DI,  Cl,  and  DCI  meet  the  requirement  for  TBO  place¬ 
ment  of  having  an  increasing  hazard  function.  However,  the 
positioning  of  the  TBO  is  at  times  a  critical  decision.  Class 
I,  which  increases  from  time  zero,  presents  no  obvious  point 
for  TBO  placement.  Class  DI  presents  a  hazard  function  which 
on  the  surface  appears  to  require  a  TBO  positioned  at  the  time 
where  the  hazard  function  begins  to  increase;  this  is  also  the 
case  with  classes  Cl  and  DCI.  It  is  natural  that  the  first 
reaction  when  viewing  these  classes  is  to  conclude  that  they 
require  a  TBO  which  would  prevent  an  increase  in  hazard  rate. 
This  may  not  actually  minimize  the  effect  of  the  hazard  func¬ 
tion.  To  illustrate  this  point,  let  us  consider  a  member  of 
class  DI. 

In  Figure  11,  two  conditions  are  shown  for  a  component — one 
condition  where  the  component  is  allowed  to  operate  for  the 
life  of  the  aircraft  (say,  3,600  hours)  and  the  other  condi¬ 
tion  where  a  TBO  is  established  at  1,200  hours  (where  the 
failure  rate  was  beginning  to  increase) .  In  this  second  con¬ 
dition,  a  potential  j.s  present  for  scheduled  removals  and  the 
associated  exposure  to  the  high  failure  rate,  infant  mortality, 
portion  of  the  hazard  function.  Because  of  this  the  number  of 
failures  over  a  3,600-hour  operating  period  could  be  greater 
in  the  second  condition  where  the  1,200-hour  TBO  was  imposed. 
Clearly,  the  TBO  may  not  reduce  the  total  number  of  failures, 
but  could  indeed  produce  more  failures.  Additionally,  higher 
total  costs  might  also  be  incurred  as  a  result  of  having  to 
perform  a  scheduled  overhaul  on  the  units  that  reach  the  TBO. 

Thus  it  should  be  obvious  that  determination  of  a  suitable 
point  for  TBO  placement,  even  in  those  classes  of  hazard  func¬ 
tions  where  an  increasing  rate  is  present,  requires  some  kind 
of  optimization  process.  The  mathematical  models  required  to 
perform  this  optimization  will  be  developed  in  Appendix  I. 
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ON-CONDITION 


1,200-HOUR  TBO 


SUMMARY  OF  CRITERIA  AND  CONSIDERATIONS 


INTRODUCTION 

The  intent  of  this  section  is  to  identify  the  method  to  be 
used  for  the  evaluation  of  the  on-condition  potential  of  heli¬ 
copter  transmissions. 

This  section  integrates  the  various  mathematical  models,  de¬ 
sign  and  testing  concepts,  and  failure  warning  and  inspection 
system  considerations  which  enter  into  the  substantiation  of 
on-condition  potential  or,  if  on-condition  is  not  practical, 
the  determination  of  the  optimum  transmission  TBO . 


SUMMARY 

The  evaluation  of  the  potential  of  helicopter  transmissions 
for  on-condition  operation  requires  the  application  of  ele¬ 
ments  of  several  mathematical  and  engineering  disciplines. 
These  elements  and  the  way  they  interact  are  identified  in 
Figure  12. 

Basically,  the  analysis  can  be  summarized  into  seven  steps: 

1.  Perform  Failure  Mode  Effects  and  Criticality  Analysis 
(FMECA) 

2.  Develop  hazard  functions  by  mode  and  combine  into  an 
assembly  hazard  function. 

3.  Perform  a  safety  evaluation. 

4.  Develop  limiting  cost-effectiveness  hazard  function. 

5.  Determine  optimum  cost-effectiveness  TBO  or  substantiate 
on-condition  potential  from  cost-effectiveness  hazard 
function. 

6.  If  on-condition  operation  is  not  safe  and  cost-effective, 
consider  impact  of  redesign,  testing,  or  failure  warning 
and  inspection  system. 

7.  Substantiate  on-condition  or  finalize  establishment  of 
TBO. 

This  section  provides  a  frame  of  reference  for  the  detailed 
mathematical  and  engineering  analyses  described  in  the  appen¬ 
dixes  and  shows  how  they  relate  to  each  other  and  to  the 
entire  evaluation.  Furthermore,  it  summarizes  each  step  in 
the  on-condition  evaluating  process,  identifying  only  those 
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Figure  12.  Method  of  Evaluating  On-Condition  Capability 


points  which  are  necessary  for  an  understanding  of  the  general 
methodology  employed  in  evaluating  on-condition  potential. 

The  following  segments  of  this  section  describe  the  steps  of 
the  analysis  shown  in  Figure  12. 


FAILURE  MODE  EFFECTS  AND  CRITICALITY  ANALYSIS  (FMECA) 


In  order  to  develop  an  adequate  mathematical  model  of  the 
transmission  hazard  function  and  provide  a  basis  for  evalu¬ 
ating  design,  test,  or  failure  warning  and  inspection  system 
impacts  upon  on-condition  potential,  it  is  necessary  that  a 
transmission  FMECA  be  developed. 

Basically,  the  FMECA  performs  three  functions: 

1.  Aids  the  designer  and  reliability  engineer  in  under¬ 
standing  the  failure  modes,  effects  of  failure,  and 
component  criticality  for  the  components  of  the  trans¬ 
mission. 

2.  Forces  identification  of  and  attention  to  all  potentially 
significant  failure  modes. 

3.  Allows  for  the  development  of  modal  hazard  functions  which 
can  be  synthesized  into  an  assembly  hazard  function  using 
the  program  identified  in  Appendix  VII. 

To  illustrate  the  manner  in  which  an  FMECA  is  performed,  a 
typical  example  has  been  included  as  Appendix  VI. 

Once  the  FMECA  has  been  performed,  the  next  major  task  is  the 
development  of  the  modal  and  subsequent  assembly  hazard 
functions . 


DEVELOPMENT  OF  MODAL  AND  ASSEMBLY  HAZARD  FUNCTIONS 

The  manner  in  which  the  hazard  functions  are  calculated  is 
dependent  upon  whether  or  not  the  gearbox  under  consideration 
is  a  new  design.  Thus,  the  following  discussion  will  consider 
old  and  new  transmissions  independently. 

New  Design 

The  preceding  section  identifies  the  detailed  steps  and  pro¬ 
vides  the  historica.l  data  base  necessary  for  developing  modal 
hazard  function.  Basically,  the  task  involves  two  steps: 
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1.  Since  it  is  a  new  design  and  no  past  data  on  the  transmis¬ 
sion  is  available,  use  CH-46,  CH-47,  UH-1E,  SH-3A,  or  the 
generic  combination  data  from  all  four  aircraft  can  be 
used  to  determine  the  distribution  of  failure  modes,  and 
the  failure  rates. 

2.  CH-47  modal  0  values  can  be  used  to  estimate  the  modal  0 
parameters  of  the  transmission  under  consideration. 

The  data  required  to  perform  these  two  steps  is  supplied  in 
Appendix  VIII.  If  data  on  a  gearbox  of  a  type  similiar  to  that 
being  analyzed  is  available,  it  should  be  used  to  replace/ 
supplement  the  data  of  Appendix  VIII. 

Having  identified  the  modal  failure  rates  and  0  values,  the 
program  supplied  in  Appendix  VII  which  relates  0,  0,  and  fail¬ 
ure  rate  can  be  used  to  determine  modal  0  values.  Thus,  the 
parameters  of  all  modal  hazard  functions  are  determined. 

Existing  Design 

In  Appendix  V  the  least-squares  fit  to  the  Weibull  Distribu¬ 
tion  is  cited  as  the  mathematical  model  for  data  analysis  best 
suited  to  the  on-condition  evaluation.  This  model  (for  which 
a  computer  program  is  discussed  in  Appendix  V  is  employed  for 
each  transmission  failure  mode  to  determine  modal  0  and  0 
values  when  historical  data  on  the  transmission  is  available. 

Once  the  modal  hazard  functions  have  been  determined  for 
either  a  new  or  existing  design,  they  can  be  combined  into  an 
assembly  hazard  function  using  the  program  in  Appendix  VII. 


PERFORMANCE  OF  SAFETY  EVALUATION 


Appendix  I  identifies  the  detailed  steps  which  must  be  taken 
to  ensure  that  a  transmission  is  safe  for  operating  on  condi¬ 
tion.  Resulting  from  the  safety  analysis  is  a  conclusion 
regarding  on-condition  acceptability  from  a  safety  aspect. 

Basically,  the  steps  identified  in  Appendix  I  for  the  perform¬ 
ance  of  the  safety  evaluation  are  as  follows: 

1  Identification  of  all  potentially  safety-affecting 
failure  modes  as  determined  by  the  FMECA, 

2.  Determination  of  those  modes  which  will  be  precluded  from 
occurring  through  application  of  failsafe  design  practices. 

3.  Determination  of  chose  modes  which  will  be  precluded  from 
occurring  through  use  of  a  failure  warning  and  inspection 
system. 
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4. 


Determination  of  those  modes  which  are  not  fail  safe  or 
detectable  but  for  which  the  modal  hazard  function  is  not 
significantly  increasing  during  the  expected  transmission 
life  cycle, 

If  there  are  any  modes  which  are  not  fail  safe  or  detectable 
and  have  significantly  increasing  hazard  functions,  they  must 
be  eliminated  through  improvements  in  design,  testing,  or 
failure  warning  and  inspection  system  before  the  transmission 
can  safely  be  operated  on  condition. 

To  aid  in  the  performance  of  the  safety  analysis,  a  discus¬ 
sion  regarding  advanced  drive  system  designs,  design-related 
criteria,  and  fail-safe  design  practices  is  contained  in 
Appendix  II.  A  discussion  regarding  failure  warning  and 
inspection  system  criteria  is  contained  in  Appendix  III,  and  a 
discussion  regarding  testing  is  contained  in  Appendix  IV. 


DEVELOPMENT  OF  LIMITING  COST-EFFECTIVENESS  HAZARD  FUNCTION 

Provided  that  on-condition  operation  has  been  determined  to  be 
safe,  the  area  of  real  benefit  of  on-condition  operation, 
namely  cost,  is  next  evaluated.  This  involves  the  development 
of  a  limiting  cost-effectiveness  hazard  function.  This  hazard 
function  represents  the  point  beyond  which  operating  on  condi¬ 
tion  becomes  more  costly  and  less  effective  than  operating 
with  a  TBO.  As  long  as  the  hazard  function  for  the  trans¬ 
mission  assembly  under  consideration  is  less  than  the  limiting 
one,  on-condition  operation  is  preferable.  Appendix  I  de¬ 
scribes  in  detail  how  to  calculate  the  limiting  cost-effective¬ 
ness  hazard  function.  Basically,  this  calculation  involves 
considerations  of  availability,  mission  reliability,  and  life- 
cycle  cost. 


DETERMINATION  OF  THE  OPTIMUM  COST-EFFECTIVENESS  TBO  OR 
SUBSTANTIATION  OF  ON-CONDITION  POTENTIAL  FROM  THE  COST- 
EFFECTI VENES S  HAZARD  FUNCTION 


This  step  in  the  on-condition  evaluation  process  involves  a 
comparison  of  the  assembly  hazard  function  with  the  limiting 
cost-effectiveness  hazard  function.  This  requires  plotting 
both  hazard  functions  on  the  same  graph  for  all  values  of  t 
up  to  the  expected  life  of  the  transmission,  If  the  assembly 
hazard  function  is  lower,  then  the  potential  of  this  assembly 
for  on-condition  operation  has  been  substantiated  from  the 
cost-effectiveness  standpoint.  If  the  assembly  hazard  func¬ 
tion  is  not  lower  than  the  limiting  cost-effectiveness  hazard 
function,  the  potential  for  on-condition  operation  has  not 
been  substantiated.  However,  further  analysis  can  determine 
the  optimum  TBO  for  cost-effectiveness. 
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IMPACT  OF  REDESIGN,  TESTING,  OR  FAILURE 
WARNING  AND  INSPECTION  SYSTEM 


When  on-condition  operation  has  not  been  substantiated  from 
both  the  safety  and  cost-effectiveness  aspects,  three  courses 
of  action  are  available  if  the  user  still  desires  to  eliminate 
scheduled  removals: 

1.  Certain  components  of  the  transmission  with  restrictive 
hazard  functions  can  be  redesigned  to  eliminate  the  mode 
or  change  the  hazard  functions. 

2.  The  transmission  can  be  manufactured  and  run  in  a  test  to 
evaluate  the  modal  hazard  functions  predicted.  In  this 
case,  the  hazard  functions  may  not  be  as  bad  as  expected 
or  additional  information  from  testing  will  lead  to  the 
insight  required  for  design  elimination  of  this  mode. 
Furthermore,  transmission  green  runs  (which  are  the 
mechanical  equivalent  of  burn-in  testing)  may  act  to 
eliminate  infant  mortality  hazard  functions. 

3.  In  the  case  where  on-condition  operation  is  unsafe  or  not 
system-effective,  the  installation  of  failure  warning  and 
inspection  systems  to  provide  ample  time  for  safe  action 
or  efficient  transmission  removal  can  be  considered. 

When  any  of  these  courses  of  action  are  chosen,  the  assembly 
hazard  function  is  then  recalculated  without  those  modal 
hazard  functions  which  have  been  eliminated. 

Redesign,  failure  warning  and  inspection  systems,  and  testing, 
are  discussed  in  detail  in  Appendixes  II,  III,  and  IV, 
respectively. 

Appendix  II  emphasizes  those  areas  of  design  that  could  possi¬ 
bly  limit  TBO  extension  or  removal.  The  dual  issues  of  failure 
consequence  and  Hazard  Function  shape  are  the  prime  concerns. 

In  instances  where  a  6  greater  than  1  might  be  present  for  a 
failure  mode,  the  designer  must  assure  that  the  assembly  is 
tolerant  of  that  failure  mode.  That  is,  the  consequence  must 
not  be  an  undetected  functional  failure.  If  safety  concerns 
can  be  eliminated  from  any  failure  mode,  a  3  greater  than  1 
can  generally  be  tolerated. 

Several  advanced  gearbox  configurations  (e.g.,  modularized, 
roller  gear,  and  lubricant  sealed  transmissions)  as  well  as 
elemental  advances  (non-involute  tooth  forms,  improved  lubri¬ 
cants,  improved  materials)  which  are  reviewed  in  Appendix  II, 
appear  to  have  great  potential  for  improving  the  suitability 
of  helicopter  gearboxes  for  on-condition  operation.  Further¬ 
more,  a  review  of  the  data  supplied  in  Appendixes  VIII  and  IX 
leads  to  the  conclusion  that  present  generation  gearboxes 
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(CH-46,  CH-47,  UH-1E,  SH-3A)  have  very  few  significantly  in¬ 
creasing,  potentially  catastrophic,  undetectable  modes  which 
could  preclude  their  operating  on-condition.  Finally,  Appen¬ 
dix  II  shows  that  in  most  instances  even  the  fatigue  failure 
modes  (which  are  generally  considered  those  requiring  life 
limits,  and  consequently  a  TBO)  should  not  prohibit  operating 
on-condition  since  they  do  not  exhibit  a  significantly  in¬ 
creasing  hazard  function. 

Appendix  III  presents  the  proper  role  for  diagnostics  or  con¬ 
dition  monitoring  in  the  TBO  question.  These  devices  or  sys¬ 
tems  contribute  to  an  on-condition  status  by  removing  failure 
modes  from  a  safety  arena  and  thereby  increasing  the  accepta¬ 
bility  of  $  >  1.  In  the  justifiable  desire  to  ease  maintenance 
troubleshooting  and  reduce  component  damage,  the  fact  that 
diagnostics  do  not  change  the  frequency  of  occurrence  or  the 
shape  of  the  distribution  is  sometimes  overlooked.  Providing 
a  30-minute  warning  of  a  bearing  failure  does  not  alter  the 
shape  of  the  hazard  function  for  the  bearing. 

In  this  light,  it  might  be  concluded  that  the  historical  em¬ 
phasis  on  diagnostics  is  inappropriate.  Instead  of  efforts  to 
increase  the  detectability  of  bearings  (which  have  generally 
constant  failure  rates:  3=1),  the  real  need  is  to  detect 
potentially  catastrophic  failure  modes  that  have  shown  a 
propensity  to  high  B's  (e.g.,  low-cycle  fatigue-sensitive 
internal  structure  such  as  supports  or  shafts).  The  dual  ob¬ 
jectives  for  diagnostics  of  minimum  maintenance/costs  and 
improved  safety,  are  not  mutually  satisfying.  Clearly,  spe¬ 
cific  objectives  must  be  defined  Appendix  III  of  this  report 
is  a  step  towards  the  development  of  the  role  of  diagnostics 
in  an  on-condition  evaluation. 

Appendix  IV  identifies  the  manner  in  which  testing  influences 
an  on-condition  analysis.  The  great  variability  in  hazard 
function  parameters  that  is  exhibited  by  small  random  samples 
has  led  to  the  conclusion  that  developmental  testing  is  of 
little  value  in  affirming  or  denying  the  existence  of  a  high 
6  parameter. 

The  primary  value  of  developmental  testing  from  an  on-condition 
aspect  lies  in  the  identification  of  failure  modes  and  estab¬ 
lishment  of  failure  mechanisms  which  facilitate  redesign  to 
eliminate  the  mode  when  possible.  Furthermore,  developmental 
testing  can  be  of  great  value  in  establishing  failure  progres¬ 
sion  rates  for  critical  components. 

The  manner  in  which  on-condition  operation  can  be  most  profit¬ 
ably  supported  through  developmental  testing  is  by  the  estab¬ 
lishment  of  a  truly  adequate  reliability  test  program.  It  is 
postulated  that  improving  reliability  will  of  necessity  also 
enhance  on-condition  potential. 
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An  example  of  the  kind  of  trade  which  could  be  required  in  an 
on-condition  analysis  is  contained  in  the  following  paragraphs. 

Consider  a  situation  where  a  gear  in  a  high  speed  critical 
load  path  application  is  mated  to  a  shaft  via  a  bolted  flange. 
This  type  of  design  is  frequently  prone  to  flange  fretting  at 
the  bolted  connection,  which  can  progress  to  web  cracking  and 
subsequent  loss  of  load  carrying  capability  resulting  in  a 
catastrophic  failure.  Fretting  failures  have  been  historically 
undetectable  due  to  the  extremely  small  size  of  the  particulate 
debris  generated.  Flange  and  web  cracking  have  also  been  vir¬ 
tually  undetectable  since  little  or  no  debris  is  generated 
prior  to  catastrophic  failure. 

For  the  sake  of  this  example  assume  that  flange  fretting  has  a 
significantly  increasing  Hazard  Function.  Then,  since  it  is 
undetectable  and  progresses  to  an  undetectable  catastrophic 
mode,  the  problem  would  have  to  be  resolved  before  the  gearbox 
would  be  acceptable  for  on-condition  operation. 

Several  alternative  solutions  to  this  problem  can  be  consid¬ 
ered.  Three  that  come  immediately  to  mind  are  as  follows: 

(1)  Redesign  the  gear/shaft  combination  to  integrally 
forge  the  unit  thus  eliminating  the  bolted  surface 

(2)  Electron-beam-weld  the  gear  to  the  shaft,  again 
eliminating  the  bolted  connection 

(3)  Improve  the  detectability  of  the  fretting  mode  via 
kryptonation  or  some  other  failure  warning  technique. 

Each  of  these  suggested  solutions  has  certain  drawbacks. 

o  Manufacturing  an  integral  gear/shaft  assembly  is  more 
difficult  and  costly  than  producing  the  two  items 
individually 

o  E.  B.  welded  joints,  tend  to  present  a  catastrophic 
cracking  mode  of  failure  if  the  weld  is  imperfect 
(E.  B.  we.'.ds  are  discussed  in  the  roller-gear  drive 
section  of  Appendix  II) . 

o  As  shown  in  the  trade  study  of  Table  XXIII  of  Appendix 
III,  the  radioactive  tracer  has  v.he  highest  rating  with 
regard  to  diagnosing  flange  fretting.  (Radioactive 
tracers,  and  in  particular  Kryptonation  are  discussed 
in  Appendix  III).  Radioactive  tracers  do  require  that 
sensitive  built-in  or  externally  supplied  sensors  be 
provided  if  they  are  to  be  effective.  Kryptonation 
also  requires  a  modification  to  the  manufacturing 
process  to  allow  for  impregnation  with  the  kryptonate. 
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Which  of  these  solutions  (or  any  other  that  can  be  postulated) 
should  be  employed  is  a  decision  that  must  be  based  on  the 
engineering  and  economic  factors  of  the  specific  application. 
The  previous  discussion  was  provided  to  demonstrate  the  kind 
of  trades  which  could  be  conducted  in  an  on-condition  analysis. 


SUBSTANTIATION  OF  ON-CONDITION  OR 
ESTABLISHMENT  OF  TBO 

Once  the  modified  assembly  hazard  function  has  been  calculated, 
it  is  again  compared  with  the  limiting  cost-effectiveness 
hazard  function.  If  the  potential  for  on-condition  operation 
is  still  not  substantiated,  one  must  decide  the  cost  and  time 
feasibility  of  iterating  the  process  described  under  the  pre¬ 
ceding  heading  or  establish  the  TBO  as  acceptable.  If  the  TBO 
course  of  action  is  chosen,  this  does  not  eliminate  the  possi¬ 
bility  of  operating  on  condition  in  the  future.  As  failed  and 
TBO  samples  are  returned  and  analyzed,  the  predicted  hazard 
functions  will  or  will  not  be  verified;  and  various  transmis¬ 
sion  modifications  will  be  incorporated,  eliminating  certain 
modes  and  making  on-condition  operation  more  viable. 
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CONCLUSIONS  AND  RECOMMENDATIONS 


NOTE:  The  conclusions  presented  here  are  based  primarily 
on  the  detailed  analyses  contained  in  the 
appendices. 


As  a  result  of  this  study,  it  is  evident  that  on-condition 
operation  for  helicopter  transmissions  would  be  extremely 
cost-effective.  In  almost  every  case  imaginable,  the  on- 
condition  transmission  would  generate  lower  costs  with  little 
degradation  of  performance  when  compared  to  a  transmission 
operated  with  a  TBO. 

Thus,  the  entire  on-condition  question  really  reduces  to  a 
safety  issue:  can  state-of-the-art  transmissions  be  operated 
safely  in  the  1,000-  to  5,000-hour  regimes?  The  answer  posed 
as  a  result  of  this  study  is  yes,  with  mitigation. 

Experience  has  shown  that  very  few  failure  modes  have  signifi¬ 
cantly  increasing  hazard  functions.  In  fact,  as  supported  by 
the  data  in  Appendix  IX  of  this  study,  most  failure  modes  have 
a  tendency  toward  decreasing  hazard  rate.  When  conservative 
design  practices  are  employed,  as  is  the  case  in  most  current 
helicopter  gearboxes,  problems  encountered  in  operation  tend 
to  be  those  generated  by  material  inclusions,  out-of-tolerance 
parts,  or  improper  assembly.  These  problems  tend  to  surface 
rapidly  when  they  exist,  thus  supporting  the  aforementioned 
tendency  of  failure  modes  to  have  decreasing  hazard  functions. 
Thus,  the  great  majority  of  failure  modes  support  (through 
their  decreasing  hazard  rates)  the  capability  of  on-condition 
transmission  operation. 

For  those  few  modes  that  are  potentially  catastrophic  and 
which  do  exhibit  increasing  rates,  there  are  state-of-the-art 
diagnostic  techniques  which  can  and  are  being  employed  to  re¬ 
duce  their  impact  from  safety-affecting  to  merely  mission-  or 
maintenance-affecting.  The  fact  that  present  diagnostics  sys¬ 
tems  are  providing  adequate  safety  measures  for  gearboxes  is 
attested  to  by  the  paucity  of  gearbox  caused  accidents.  Again 
it  should  be  reiterated  that  although  the  concept  of  operation 
on-condition  is  new,  it  is  not  untested,  since,  as  previously 
stated,  all  components  do  in  fact  operate  on-condition  to  some 
extent  right  now. 

Thus  it  is  concluded  that  through  application  of  the  methodol¬ 
ogy  defined  herein,  coupled  with  conservative  design  practices, 
adequate  developmental  and  problem-identification  testing,  and 
prudent  application  of  state-of-the-art  diagnostic  techniques, 
on-condition  operation  of  helicopter  transmissions  can  now 
become  a  reality  for  current  and  future  systems. 
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APPENDIX  I 

DEVELOPMENT  OF  LIMITING  COST-EFFECTIVENESS  HAZARD  FUNCTION 


INTRODUCTION 

The  intent  of  this  section  is  to: 

1.  Develop  and  demonstrate  the  methodology  for  evaluating  the 
effect  of  on-condition  operation  upon  cost,  reliability, 
maintainability,  availability,  and  safety. 

2.  Identify  the  manner  in  which  the  limiting  cost- 
effectiveness  hazard  function  can  be  calculated. 

The  limiting  cost-effectiveness  hazard  function  is  the  mathe¬ 
matical  relationship  used  to  establish  the  optimum  TBO  or, 
conversely,  to  substantiate  the  potential  for  on-condition 
operation. 


SUMMARY 

In  the  following  segments  of  this  section,  each  of  the  param¬ 
eters  (cost,  reliability,  maintainability,  availability,  and 
safety)  is  looked  at  independently.  For  all  parameters  except 
safety,  the  effect  of  a  change  in  0  and  9  caused  by  TBO  remov¬ 
al  is  evaluated  parametrically  by  using  the  simulation  model 
discussed  in  Appendix  V.  For  these  four  parameters,  carpet 
plots*  are  developed,  identifying  the  effect  of  changes  in  0 
and  0  upon  each  parameter.  Furthermore,  in  the  case  of  cost 
and  maintainability,  limiting  hazard  functions  are  developed 
by  comparing  the  results  of  a  baseline  run,  generated  with  a 
1,200-hour  TBO,  with  the  results  shown  on  the  respective 
carpet  plots. 

Limiting  hazard  functions  are  not  developed  for  mission  relia¬ 
bility  or  availability.  It  should  be  obvious  from  previous 
discussions  regarding  hazard  functions  that  any  increase  in 
hazard  rate  after  TBO  will  result  in  a  decrease  in  effective 
MTBF  for  the  transmission.  Thus,  availability  and  mission 
reliability,  which  are  essentially  dependent  only  upon  MTBF, 
must  decrease  whenever  the  hazard  function  is  increasing. 

Thus,  it  should  be  reiterated  that  in  operating  on-condition 
with  an  increasing  hazard  function,  slightly  decreased  effec¬ 
tiveness  is  being  traded  against  greatly  decreased  cost. 


*A  carpet  plot  is  a  2~dimensional  display  capable  of  repre¬ 
senting  a  relationship  between  3  variables  by  using  a  sliding 
scale  for  locating  the  2  independent  variables. 
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\nother  comment  regarding  limiting  hazard  functions  seems  in 
order.  These  relationships  (limiting  hazard  functions)  are 
developed  for  cost  and  maintainability  merely  to  give  a  visual 
representation  of  the  amount  of  increase  in  hazard  rate  that 
can  be  tolerated  from  operating  on-condition  and  still  be  more 
effective  than  operating  with  a  TBO.  It  is  postulated  that 
for  some  people  employing  the  methodology  developed  in  this 
study,  cost  or  maintainability  could  be  of  such  great  impor¬ 
tance  that  cost-effectiveness  trades  may  not  be  considered. 

In  this  case,  it  would  then  be  mandatory  that  the  limiting 
cost  or  maintainability  hazard  function  be  developed. 

For  those  employing  the  total  methodology  (that  is,  all  param¬ 
eters  up  to  and  including  cost-effectiveness) ,  there  is  no 
need  to  develop  the  limiting  hazard  function  for  cost  and 
maintainability.  Work  in  these  areas  can  be  terminated  with 
the  completion  of  the  respective  carpet  plots  for  cost  and 
maintainability. 

The  relationship  of  cost-effectiveness  to  changes  in  6  and  e 
resulting  from  TBO  removal  is  identified  through  the  applica¬ 
tion  of  a  cost-effectiveness  model  developed  in  this  section. 

A  carpet  plot  relating  cost-effectiveness  to  changes  in  g  and 
0  is  developed.  Finally,  this  carpet  plot  is  comp?  'd  to  the 
baseline  run  (1,200-hour  TBO)  and  a  limiting  cost  ective- 
ness  hazard  function  is  developed. 

Safety  requires  and  receives  a  separate  treatment  in  this 
section.  A  methodology  is  identified  for  evaluating  whether  a 
transmission  is  safe  for  operation  on  condition.  This  method¬ 
ology  is  then  used  to  make  a  decision  regarding  the  optimum 
position  for  a  TBO  (if  on  condition  is  not  possible)  from  a 
safety  aspect. 


LIMITING  COST  HAZARD  FUNCTION 

To  determine  the  limiting  cost  hazard  function  (LCHF) ,  it  is 
necessary  that  the  following  data  be  known  (as  in  the  case  of 
a  CH-47  transmission)  or  hypothesized  (as  would  be  the  case 
with  a  new  design) : 

1.  Logistics  costs  (shipping,  administration,  MMH’s,  etc.) 

2.  Scheduled  overhaul  cost 

3.  Unscheduled  overhaul  cost 

4.  Unscheduled  repair  cost 

5.  Present  TBO 
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6 .  3 ,  0 ,  up  to  TBO 

7.  Utilization,  life-cycle  duration,  and  fleet  size 

Assuming  that  data  items  1-4  will  remain  unchanged  with  an 
increase  in  TBO  (or  OC  operation) ,  we  incrementally  evaluate 
increased  (or  decreased)  values  of  3  and  9,  past  TBO,  to  iden¬ 
tify  the  number  of  unscheduled  removals  for  each  combination 
of  3  and  0 . 

All  cost  factors  (1  through  4)  should  now  be  added  to  deter¬ 
mine  the  relative  cost  of  scheduled  versus  unscheduled 
removal;  that  is,  if  a  scheduled  removal  and  subsequent  over¬ 
haul  are  assumed  to  cost  1.0  cost  units,  then  unscheduled 
overhaul  will  cost  a  cost  units,  where 


a  _  unscheduled  overhaul  cost  (total) 
scheduled  overhaul  cost  (total) 

where  unscheduled  overhaul  cost  (total)  =  unscheduled  overhaul 

cost  and  logistics  cost 

and  scheduled  overhaul  cost  (total)  =  scheduled  overhaul  cost 

and  logistics  cost. 

Similarly,  the  relative  cost  of  unscheduled  repair  would  equal 
b  cost  units,  where 


b  =  unscheduled  repair  cost  (total) 
scheduled  overhaul  cost  (total) 

and  unscheduled  repair  cost  (total)  =  unscheduled  repair  cost 

and  logistics  costs. 

Thus,  using  the  values  1.0,  a,  and/or  b  for  scheduled  and 
unscheduled  overhaul/repair  cost  ratios,  one  simulates  two 
cases — first  with  the  original  TBO,  and  then  with  a  new  TBO 
(or  on  condition) — and  identifies  the  total  number  of  scheduled 
and  unscheduled  removals.  The  number  of  removals  is  then 
multiplied  by  the  appropriate  cost  ratios  to  determine  which 
manner  of  operation  costs  less. 

The  following  example  has  been  developed  to  identify  the  steps 
necessary  for  the  development  of  a  limiting  cost  hazard 
function. 
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1.  Identify  Pertinent  Data 


Logistics  costs 

Scheduled  overhaul  cost 

Unscheduled  overhaul  cost 

Unscheduled  repair  cost 

Present  TBO 

6 

0 

Utilization,  life-cycle 
duration,  and  fleet  size 


$1.-784 

$11,000  =  1.00  unit 
$22,000  =  2.00  units  -  2 
$7,481  =  0.68  unit  =  b 

1,200  hours 

1.0 

2,870.0  hours 

60  hours  per  aircraft 
per  month 
9  years 
100  aircraft 


2.  Employing  the  simulation  model  discussed  in  Appendix  V, 
run  the  baseline  run  and  then  delete  the  TBO  and  paramet¬ 
rically  vary  6  and  8  past  the  original  TBO  to  identify  the 
number  of  unscheduled  removals  that  would  be  generated  if 
the  TBO  were  removed  and  the  hazard  function  were  to 
change.  This  data  is  presented  in  Table  II  for  the  ex¬ 
ample  case. 

3.  Plot  the  cost  versus  3  and  8  after  TBO,  as  shown  in  Figure 
13.  Cost  equals  a  times  the  number  of  unscheduled  remov¬ 
als  plus  one  times  the  number  of  scheduled  removals. 

4.  Construct  a  line  on  the  cost  chart  at  the  cost  value  de¬ 
rived  for  the  baseline  case.  This  line  is  shown  as  the 
dotted  line  in  Figure  13. 

5.  Construct  an  indifference  curve  using  the  points  where  the 
carpet  plot  of  Figure  13  intersects  the  baseline  dotted 
line.  The  indifference  curve  is  shown  in  Figure  14.  In 
this  case,  goodness  is  above  the  line. 

6.  Find  the  point  on  the  indifference  curve  which  satisfies 
the  following  criteria: 

(JL)  (tBO)  6-1  =  (-J-L-)  (tBO)3'"1 
0°  6  '  6 
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TABLE  II. 

COST  FOR 

VARIOUS  VALUES 

OF  6'  AND  6' 

ENCOUNTERED  BY  REMOVING 

TBO 

8' 

0  ' 

Failures 

Cost 

0.5 

1,000 

243 

486 

1.0 

1,000 

462 

924 

2.0 

1,000 

510 

1,020 

3.0 

1,000 

536 

1,072 

4.0 

1,000 

562 

1,12* 

5.0 

1,000 

570 

1,140 

1.0 

1,500 

363 

726 

2.0 

1,500 

399 

798 

4.0 

1,500 

409 

818 

1.0 

2,000 

296 

592 

2.0 

2,000 

312 

624 

3.0 

2,000 

332 

664 

4.0 

2,000 

336 

672 

5.0 

2,000 

338 

676 

1.0 

2,500 

248 

496 

2.0 

2,500 

275 

550 

3.0 

2,500 

284 

568 

4.0 

2,500 

285 

570 

0.5 

3,000 

161 

322 

1.0 

3,000 

213 

426 

2.0 

3,000 

243 

486 

3.0 

3,000 

247 

494 

4.0 

3,000 

242 

484 

5.0 

3,000 

238 

476 

3.0 

3,500 

219 

438 

200 


B' 


Figure  14.  Equal  Cost  Indifference  Curve. 
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where  6,  9,  and  TBO  are  the  baseline  values,  and  8'  and  9' 
are  the  values  off  the  indifference  curve. 

It  is  necessary  that  this  equality  be  satisfied  to  fulfill 
the  requirement  that  the  hazard  function  should  not  be 
discontinuous  at  time  equals  TBO.  In  other  words,  it  is 
unlikely  that  one  hour  after  t  =  TBO,  the  hazard  function 
would  become  entirely  different.  Rather,  it  would  change 
continuously  as  time  increased. 

7.  Construct  the  limiting  cost  hazard  function  using  the  8 
and  9  values  to  calculate  the  hazard  rate  up  to  TBO  and 
using  8'  and  0'  resulting  from  Step  6  to  calculate  the 
hazard  rate  past  TBO.  This  plot  is  shown  in  Figure  15. 


LIMITING  HAZARD  FUNCTION  FOR  MAINTAINABILITY 

In  order  to  construct  a  limiting  hazard  function  for  maintain¬ 
ability,  the  following  data  must  be  identified: 

1.  Unscheduled  MMH/removal 

2.  Scheduled  MMH/removal 

3.  Present  TBO 

4 .  6 ,  9  up  to  TBO 

5.  Utilization,  life-cycle  duration,  and  fleet  size 

With  the  assumption  that  item  1  would  be  the  same  for  an  on- 
condition  transmission,  it  is  possible  to  evaluate  the  limiting 
hazard  function  for  maintainability. 

Let  unscheduled  MMH/removal  =  1.0  unit  and  scheduled  MMH/ 

removal  =  a  unit 

where  a,  in  most  instances  for  a  transmission  since  there  is 
no  need  for  troubleshooting,  is  less  than  1.0.  For  the  ex¬ 
ample  plots  of  this  section,  let  a  =  0.5. 

The  equal  MMH  relationship  that  must  hold  for  an  on-condition 
versus  TBO-limited  component  is 

a  •  no.  of  scheduled  removals  (with  TBO)  +  no.  of 
unscheduled  removals  (with  TBO)  =  unscheduled  removals 

(on  condition) . 

Now  the  procedure  for  evaluating  the  limiting  maintainability 
hazard  function  is  the  same  as  for  the  limiting  cost  hazard 
function . 
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1.  Using  the  baseline  data  for  0,  0  and  TBO,  simulate  fleet 
operation  ever  a  time  frame  and  calculate  total  scheduled 
and  unscheduled  removals. 

2.  Parametrically  vary  6'  and  0'  past  TBO  for  on-condition 
components  to  establish  the  relationship  between  S',  0' 
and  total  unscheduled  removals.  Since  this  data  could 

be — and  in  this  example  is — the  same  as  that  developed  in 
the  previous  section  and  shown  in  Table  II,  this  table  is 
not  repeated.  Now  use  this  data  to  construct  a  plot  of 
unscheduled  maintenance  man-hours  versus  $'  and  0'.  This 
relationship  is  shown  in  Figure  16. 

3.  Using  the  relationship 

a  •  no.  of  scheduled  removals  (with  TBO)  +  no.  of 
unscheduled  removals  (with  TBO)  =  baseline  MMH  units, 

calculate  the  number  of  unscheduled  MMH  which  are  gener¬ 
ated  with  a  TBO  (baseline  MMH  units) . 

4.  Place  this  line  on  the  carpet  plot  (Figure  16)  and  distin¬ 
guish  points  which  are  used  to  generate  the  indifference 
curve  (Figure  17) . 

5.  Calculate  hazard  rate  for  original  6  and  0  at  TBO. 

6.  Pick  out  points  on  the  indifference  curve  and  calculate 
hazard  rates  by  trial  and  error  until  a  solution  (0',  o') 
is  found  that  yields  the  same  value  for  the  hazard  func¬ 
tion  at  TBO,  as  does  the  baseline  hazard  rate. 

7.  Construct  the  limiting  maintenance  man-hours  hazard  func¬ 
tion  using  the  values  of  B,  0  previous  to  TBO  and  the  0' 
and  0'  values  found  earlier  for  calculation  of  the  hazard 
rate  after  TBO.  See  Figure  18. 


RELIABILITY 

For  transmissions,  there  are  three  kinds  of  reliability: 
maintenance  reliability,  mission  reliability  and  safety  relia¬ 
bility.  Safety  reliability  will  be  addressed  as  a  separate 
entity  in  a  following  section  of  the  paper.  Maintenance  re¬ 
liability  impacts  the  following  areas:  cost,  maintenance,  end 
availability.  The  sensitivity  of  cost  and  maintenance  to  on- 
condition  operation  has  been  discussed  in  the  preceding  sec¬ 
tions,  while  availability  will  be  discussed  independently  in  a 
following  section.  Therefore,  the  analysis  that  will  be  per¬ 
formed  in  this  section  will  deal  solely  with  the  effect  of 
on-condition  operation  upon  mission  reliability. 
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o  1,200  2,400  3,600 

TRANSMISSION  HOURS 


Figure  18.  Limiting  MMH  Hazard  Function. 
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The  method  for  evaluating  the  effect  of  on-condition  operation 
upon  mission  reliability  is  based  upon  the  assumption  that 
mission  aborts  can  be  predicted  as  a  function  of  the  unsched¬ 
uled  removal  rate.  This  is,  mathematically 


X 


Mission 

Abort 


=  K 


^Maintenance^ 


C 


where  K  and  C  are  proportionality  constants  (C  is  generally 
assumed  to  =  1.0)  dependent  upon  gearbox  configuration,  rather 
than  the  magnitude  of  the  maintenance  malfunction  rate. 

Now  if  we  assume  that  K  and  C  are  independent  of  TBO,  the 
manner  in  which  the  impact  of  on-condition  maintenance  upon 
mission  reliability  can  be  evaluated  is  as  follows: 

1.  Estimate  K  and  C  either  from  historical  data  or  based 

upon  reliability  predictions  and  failure  mode  effect  and 
criti-cality  analysis. 

The  following  example  illustrates  this  point. 

For  gearbox  X  in  815,000  hours  of  fleet  operation,  284 
unscheduled  removals  and  1  mission  affecting  malfunc¬ 
tions  have  occurred.  Thus, 


\  ^ _ 

Mission  815,000 

Abort 

X  =  1 

Maintenance  2870 


0.000001227 

0.0003484 


Therefore,  0.000001227  =  K  (0. 0003484)°  and  for  C  =  1.0, 

we  find  K  =  0.00352147 


2.  Using  the  failure  distribution  parameters,  3,  0  and  TBO 
for  the  gearbox,  run  the  previously  utilized  simulation 
model  to  identify  the  number  of  failures  generated  for  the 
baseline.  Convert  this  to  a  failure  rate  and  multiply 
this  by  K  to  develop  the  mission  affecting  X  resulting 
from  the  baseline  simulation. 

Next  calculate  the  baseline  mission  reliability  using  the 
formula 


ft 

Mission 


"^Mission 

e 


t 


where  t  =  the  length  of  the  particular  mission  for  which 
the  aircraft  being  simulated  is  employed. 

3.  Now  parametrically  vary  the  3  and  6  after  TBO  (as  was  done 
to  develop  the  limiting  cost  and  maintainability  hazard 
function)  and  run  the  simulation  to  identify  the  number  of 
unscheduled  removals  that  would  be  generated  in  on- 
condition  gearbox  operations.  Again  convert  this  to  a 
rate  per  hour  and  multiply  by  K  to  develop  a  set  of  mis¬ 
sion  affecting  X's.  Again  use  the  equation 

“^Mission  * 

%ission  “  e 

to  develop  a  set  of  mission  reliability  values  for  para¬ 
metrically  varying  levels  of  increasing  hazard  rate  past 
TBO. 

4.  Now  develop  a  carpet  plot  of  mission  reliability  versus  g ' 
and  0'.  Although  a  limiting  hazard  function  will  not  be 
developed  for  mission  reliability,  these  values  will  be 
employed  in  the  final  step  of  the  analyses  which  is  the 
development  of  the  limiting  hazard  function  for  cost- 
effectiveness.  To  construct  a  carpet  plot  for  mission 
reliability  for  the  example,  employ  the  value  for  K  which 
was  previously  calculated  and  assume  C  =  1.0.  This  value 
is  based  on  815,000  hours  of  CH-47A  aft  transmission 
experience.  See  Figure  19. 

This  carpet  plot  will  be  utilized  in  developing  the  limit¬ 
ing  cost-effectiveness  hazard  function  in  the  .last  segment 
of  this  section. 


AVAILABILITY 

As  stated  in  the  main  text  of  the  report. 


Inherent  Availability  = 


MTBF 

MTBF  +  MTTR 


where  MTTR  =  organizational  mean  time  to  remove. 

The  MTTR  is  independent  of  TBO;  therefore,  the  limiting  hazard 
function  for  availability  is  really  dependent  only  upon  MTBF. 
It  should  be  obvious  from  previous  discussions  that  if  a 
transmission  has  an  increasing  hazard  function  past  TBO,  the 
average  MTBF  will  be  decreased  by  on-condition  operation. 

Thus,  for  components  exhibiting  an  increasing  hazard  function, 
on-condition  operation  will  result  in  a  decrease  in  avail¬ 
ability.  However,  the  magnitude  of  this  decrease  must  be 
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Figure  19.  Relationship  of  Mission  Reliability  to  8'  and 


quantified  before  a  loss  in  availability  can  be  traded  off 
against  potential  increases  in  cost-effectiveness  resulting 
from  on-condition  operation.  Thus,  it  is  necessary  to  para¬ 
metrically  investigate  the  sensitivity  of  availability  to 
on-condition  operation.  To  do  this,  the  following  steps  must 
be  taken: 

1.  Using  the  failure  distribution  parameters  0,  6  and  TBO  for 
the  gearbox,  run  the  previously  utilized  simulation  model 
to  identify  the  number  of  failures  generated  for  the  base¬ 
line.  Convert  this  figure  into  an  MTBF  and  calculate  the 
baseline  availability  using  the  equation 

-  _  MTBF 

1  MTBF  +  MTTR 

(where  MTTR  is  known  from  experience  or  estimated  by 
maintenance  engineering  analysis). 

2.  Parametrically  vary  0‘  and  0'  after  TBO  and  run  the  sim¬ 
ulation  model  to  identify  the  number  of  unscheduled 
removals  that  would  be  generated  in  on-condition  gearbox 
operation.  Again  convert  the  values  into  MTBF's  and  cal¬ 
culate  the  resulting  availability  values. 

3.  Develop  a  carpet  p)ot  of  availability  versus  6 '  and  0' 
(Figure  20) .  These  values  will  be  used  in  the  development 
of  the  limiting  hazard  function  for  cost-effectiveness. 

At  this  time  the  conservative  nature  of  inherent  availability  as 
a  tool  for  measuring  the  potential  of  on-condition  operation 
should  be  restated. 


Achieved  availability  has  been  stated  as 


Aa 


MTBR 

MTBR  +  MDT 


If  one  were  to  use  achieved  availability  in  this  evaluation, 
scheduled  removals  resulting  from  TBO  imposition  would  have  to 
be  used  in  the  comparison.  When  this  happens,  on-condition 
operation  always  yields  fewer  total  removals  and  therefore, 
higher  availability  than  operating  with  a  TBO.  For  example, 
using  the  simulation  model  of  fleet  operation  developed  in 
Appendix  IV,  the  following  results  were  produced.  With  a  6  of 
2.0  and  a  9  of  3500  hours,  the  fleet  operating  with  a  TBO  had 
accumulated  481  total  removals  after  more  than  600,000  hours 
of  operation.  Holding  everything  constant,  but  eliminating 
the  TBO,  resulted  in  only  169  removals.  Although  this  169 
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represented  failures,  while  the  481  was  comprised  of  64  fail¬ 
ures  and  417  scheduled  removals,  achieved  availability  would 
have  been  higher  and  cost  lower  for  operation  without  a  TBO. 

It  would  seem  rather  easy  to  justify  on-condition  operation 
using  achieved  availability. 

Instead  of  achieved  availability,  using  inherent  availability 
compares  the  on-condition  transmission  with  the  TBO  unit  on 
the  basis  of  failure  rate  and  eliminates  the  artificial  factor 
of  scheduled  removals  which  results  in  a  conservative  contrast. 


SAFETY 


On-condition  transmission  operation  can  be  a  viable  mainte¬ 
nance  philosophy  only  if  safety  does  not  deteriorate  after 
TBO.  As  previously  stated,  due  to  the  few  transmission- 
caused  helicopter  accidents,  it  is  virtually  impossible 
to  rigorously  define  a  safety  hazard  function.  Thus, the 
approach  used  in  evaluating  safety  is  necessarily  very  dif¬ 
ferent  from  that  used  in  the  preceding  sections  of  this 
report. 

The  major  steps  in  the  safety  evaluation  (Figure  21)  are  to: 

1.  Perform  a  failure  modes  effects  and  criticality  analysis 
(FMECA)  which  generates  a  list  of  all  critical  modes. 

2.  Consider  the  fail-safe  design  features  of  the  gearbox  to 
determine  those  remaining  modes  which  are  not  fail  safe 
(fail  catastrophic  modes) . 

3.  Consider  the  failure  warning  and  inspection  system  of  the 
gearbox  to  identify  the  fail  catastrophic  modes  which  are 
undetectable  and  unpredictable. 

4.  Consider  the  historically  expected  3  to  identify  which  of 
these  modes  have  increasing  hazard  functions  and  are, 
therefore,  adverse  to  on-condition  operation. 

5.  For  those  undetectable,  fail  catastrophic  components  with 
3  values  greater  than  1,  estimate  modal  0  values  using 
historical  data  or  reliability  predictions.  Next,  employ 
the  program  relating  Sio  or  G  to  hazard  rate  to  evaluate 
whether  they  have  significantly  increasing  hazard  rates 
within  their  maximum  expected  life  (i.e.,  5,000  hours). 

6.  Any  modes  remaining  (i.e.,  undetectable,  fail  catastrophic, 
and  significantly  increasing  hazard  rate)  should  be  elim¬ 
inated  by  design,  test  or  failure  warning  if  the  gearbox 

is  to  operate  on  condition. 
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As  was  the  case  fcr  mission  reliability  and  availability,  it 
is  not  necessary  to  develop  a  limiting  hazard  function  for 
safety.  Also,  as  previously  stated,  due  to  the  impact  of  safety 
considerations  upon  aircraft  operation,  it  is  not  a  parameter 
for  tradeoff  versus  cost-effectiveness  and  therefore  will  not  be 
included  in  the  model  for  cost-effectiveness. 

In  conclusion,  it  should  be  reiterated  that  since  transmission 
safety  affecting  failure  data  is  scarce,  performance  of  tasks 
(4)  and  (5)  may  be  exceedingly  difficult.  It  is  anticipated 
that  a  great  deal  of  engineering  analysis,  rather  than 
rigorous  mathematics,  may  be  required  to  make  decisions. 

This  potential  lack  of  ability  to  perform  these  tasks  should 
not  be  permitted  to  prohibit  completion  of  the  safety  analysis. 


DEVELOPMENT  OF  COST-EFFECTIVENESS 


As  demonstrated  in  ALCM  -  3234-LC(A) ,  a  measure  of  effective¬ 
ness  (MOE)  which  can  be  employed  to  monitor  system  effective¬ 
ness  is 

MOE  =  F  (inherent  availability,  dependability,  capability) . 

As  identified  in  the  Army  document  and  modified  for  pertinence 
to  helicopter  transmissions, 

[AI]  =  Availability  Index  =  [Avail,  1-A^^] 

[DI]  =  Dependability  Index  =  pMission,  1  "  RMissionl 

L  0,  0  J 

[Cl]  =  Capability  Index  =  J~  1 J 

Therefore,  MOE  =  [AI]  *  [DI]  *  [Cl]  which  simplifies  upon 
matrix  multiplication  to  MOE  =  Availability  •  FvMission. 

Thus,  one  can  extrapolate  to  development  of  a  cost-effectiveness 
measure  (CMOE)  by  using  the  relationship 


CMOE 


MOE 

LCC 


where  LCC  equals  some  measure  of  life  cycle  cost — possibly  cost 
per  flight  hour.  "ince  the  MOF  values  will  be  less  than  one, 
values  for  LCC  should  be  kept  down  to  some  reasonable  unit 
i i.e.,  cost  values  should  probably  be  in  the  range  of  one  to 
1,000)  so  that  the  range  of  values  for  CMOE  will  not  be  so 
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infinitesimal  that  fluctuations  will  be  undetectable  due  to 
calculating  machinery  limitations. 

The  performance  of  this  analysis  is  demonstrated  using,  as  an 
example,  the  baseline  data  previously  employed. 


6  =  2,870  hr 

8  =  1.0 

TBO  =  1,200  hr 
No.  of  Aircraft  =  100 
No.  of  Months  =  108 

Average  Utilization  =60  hours/aircraft/month 

Scheduled  Removal  Cost  =  1.0  Unit 
Unscheduled  Removal  Cost  =  2.0  Units 


Thus,  the  equation  to  be  solved  is 


CMOE 


Availability  •  RMission 
LCC 


MTBF  .  e-K  •  X  •  t 

MTBF  +  MTTR _ 

^umber  of  Removals  *  ^os*"  Per  Removal 


_ Number  of  Hours _ K*No  of  Unsch  •  t 

Number  of  Unscheduled  Removals _  #  Removals _ 

Number  of  Hours _  *  e  Number  of  Hours 

Number  of  Unscheduled  Removals  +  _ 

Number  of  Total  Removals  •  Cost  per  Removal 


o  Now  for  the  baseline  run  and  all  subsequent  simulation  runs. 
Number  of  Hours  is  approximately  constant  at  600,000. 

o  From  historical  data, K  (the  ratio  of  mission  affecting 
transmission  failures  to  total  unscheduled  removals)  is 
approximately 

„  _  2,870  _  0 . C  03521 

815,000 

o  Historically,  the  MTTR  for  unscheduled  transmission  removals 
has  run  about  5.0  hours. 

o  Let  t  =  mission  length  =  1.0  hour 
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number  of  unscheduled  removals 


Now  for  simplicity  let  Ny  = 

and  Nt  =  number  of  total  removals 

Then, the  equation  for  CMOE  becomes 


CMOE 


600,000 

Ny  -0.003521 

600,000  ,  Z  I  *  e  600,000  *  Nu 

Ny  +5.0 

2  •  NU  +  (NT  -  Ny) 


1 

120,000 

Ny 

nt 


-  0 , 0000000059 "Ny 


+  Nu 


Now  calculate  CMOE  for  the  baseline  case  in  order  to  construct 
a  limiting  hazard  function  for  CMOE. 

For  the  baseline  case 


Ny  =  221 
Nt  =  603 


CMOE 


1  "  120  o'oo - *  1  -0.0000000059  •  221 

271  +  1 

603  +  221 


=  0.00121135972977 


For  on-condition  operation  to  be  more  efficient  than  operating 
with  a  TBO  (at  1,200  hours),  the  solution  to  the  CMOE  equation 
must  be  greater  than  0.00121135972977. 

Thus,  using  the  numbers  of  failures  generated  by  parametrically 
varying  8 '  and  O'  in  the  limiting  cost  hazard  function  section 
of  this  chapter,  it  is  now  possible  to  develop  a  carpet  plot 
of  CMOE  versus  8'  and  O'  after  TBO  (Figure  22).  This  estab¬ 
lishes  the  foundation  for  development  of  the  equal  cost- 
effectiveness  indifference  curve  (Figure  23)  and  subsequently 
the  limiting  cost-effectiveness  hazard  function  (Figure  24) . 

It  should  be  noted  here  that  the  model  for  cost-effectiveness 
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Figure  22.  Relationship  of  Cost-Effectiveness  to  8'  and 


Figure  24.  Limiting  Cost-Effectiveness  Hazard  Function. 
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W- 


1 


M. 


developed  in  this  section  gives  availability,  mission  relia¬ 
bility,  and  cost  equal  attention.  However,  if  based  upon  the 
specific  application  of  the  aircraft  under  consideration  one 
parameter  is  significantly  more  important  than  another,  the 
CMOE  equation  can  be  modified  simp. y  by  using  a  weighting 
factor  on  each  parameter.  It  is  suggested  that  an  equation  of 
the  following  form  would  be  most  applicable  in  the  weighted 
case 


CMOE 


0  -  (1-*inhergnt>V)  ~  0  ~  11  ~  RHission)L) 
M  •  {Life-Cycle  Cost) 


where  V,  L,  M  are  weighting  factors  for  availability,  mission 
reliability  and  life-cycle  cost,  respectively. 

Finally,  Figure  25  has  been  developed  to  identify  the  effect 
of  changes  in  MTBF  upon  both  availability  and  mission 
reliability . 

For  Figure  25,  an  MTTR  value  of  5  hours  and  a  K  value  of 
0.003521  were  used  in  the  availability  and  mission  reliability 
equations  previously  developed. 

Optimum  TBO 


The  transmission  data  analyzed  for  this  study  report  was 
almost  exclusively  concerned  with  transmissions  which  have 
operated  for  1,200  hours  or  less,  since  few  have  operated  be¬ 
yond  this  regime.  The  modal  hazard  functions  observed  in  this 
data  have  shown  B's  predominantly  around  1.0  or  less.  With 
B's  of  1.0  or  less,  the  assembly  hazard  function  will  almost 
always  be  less  than  the  limiting  cost-effectiveness  hazard 
function  derived  from  a  baseline  TBO  case,  and  on-condition 
operation  will  always  be  preferable  to  operation  with  a  TBO. 

When  the  assembly  hazard  function,  however,  has  a  6  greater 
than  1.0,  operation  with  a  TBO  may  be  more  cost-effective  and 
require  a  case-by-case  evaluation.  The  method  of  determining 
the  optimum  TBO  is  straightforward,  and  involves  four  steps: 

1.  Determine  the  assembly  hazard  function. 

2.  Determine  the  relative  costs  of  scheduled  and  unscheduled 
removals . 

3.  Using  the  computer  program  developed  in  Appendix  V,  simu¬ 
late  fleet  operation  up  to  the  expected  life  of  the  trans¬ 
mission,  assuming  the  assembly  hazard  function  just 
determined  and  varying  the  TBO  for  each  run,  up  to  its 
expected  life.  This  will  yield  the  expected  number  of 
scheduled  and  unscheduled  removals  for  each  TBO. 
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Figure  25.  Comparison  of  the  Effect  of  MTBF  Upon  Inherent 
Availability  and  Mission  Reliability. 
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4.  Using  the  relative  costs  determined  in  step  2,  calculate 
the  expected  total  cost  for  scheduled  and  unscheduled 
removals,  for  various  TBO’s. 

The  optimum  TBO  will  yield  the  lowest  cost.  Although  this 
seemingly  is  based  on  cost  and  ignores  cost-effectiveness,  this 
is  not  so.  Cost-effectiveness  is  a  function  of  cost,  mission 
reliability  and  inherent  availability.  With  ar  increasing 
hazard  function,  raising  the  TBO  above  the  lowest  cost  TBO 
results  in  additional  failures.  Since  mission  reliability  is 
a  function  of  unscheduled  removal  rate,  choosing  a  higher  TBO 
in  this  case  would  result  in  reduced  mission  reliability. 
Furthermore,  inherent  availability  is  based  on  MTBF;  there¬ 
fore  choosing  a  higher  TBO  yielding  more  failures  results  in 
a  lower  MTBF  and  a  lower  inherent  availability.  As  a  result, 
the  lowest  cost  TBO  is  the  optimum  TBO. 

An  example  best  illustrates  this  process.  Using  the  steps 
just  described: 

1.  Assume  a  hazard  function  with  a  6f  of  2.0  and  a  0*  of 
2,500  hours. 

2.  Assume  that  an  unscheduled  removal  costs  twice  as  much  as 
a  scheduled  removal. 

3.  The  computer  program  yields  the  following  data  shown  in 
Table  III. 


TABLE 

III.  SIMULATION  RESULTS 

FOR  $'=2,  0  1  =  2 , 500 

TBO 

Scheduled  Removals 

Unscheduled  Removals 

1,000 

517 

100 

2,000 

174 

175 

3,000 

61 

221 

3,600 

23 

235 

3,800 

19 

237 

4,000 

14 

241 

4,200 

8 

243 

5,000 

3 

248 

4.  Using  the  relative  cost  of  2  to  1  and  1  to  1,  for  unsched¬ 
uled  and  scheduled  removals,  Table  IV  can  be  developed. 
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TABLE  IV.  SIMULATED 

COSTS 

FOR  VARIOUS  COST  RATIOS 

Removals 

Total 

Cost 

TBO 

Scheduled 

,  Unscheduled 

1:2 

1:1 

517 

100 

717 

617 

2,000 

174 

175 

524 

349 

61 

221 

503 

282 

3,600 

23 

235 

493 

258 

3,800 

19 

237 

493 

256 

4,000 

14 

241 

494 

255 

4,200 

8 

243 

496 

251 

5,000 

3 

248 

499 

251 

In  the  1:2  case,  the  optimum  TBO  should  be  3,600  hours. 
Although  a  TBO  of  3,800  hours  yields  the  same  costs,  it  results 
in  more  failures  and  consequently  is  not  cost-effective  since 
mission  reliability  and  inherent  availability  would  be  lower. 

It  should  be  noted  that  as  t  le  cost  of  unscheduled  removals 
approaches  or  even  goes  be]  ..  the  cost  of  scheduled  removals, 
this  analysis  for  optimum  TbO  becomes  irrelevant,  since  it 
almost  always  becomes  more  cost  effective  to  go  on  condition. 
As  is  shown  in  the  1:1  cost  column  of  Table  IV,  costs  never 
rise  again  with  increases  in  TBO  as  evidenced  in  the  1:2 
column. 
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APPENDIX  II 

DESIGN-RELATED  CRITERIA 


INTRODUCTION 

This  appendix  contains: 

(1)  A  discussion  of  the  effect  of  using  advanced  trans¬ 
mission  elements  to  improve  on-condition  transmission 
potential 

(2)  A  qualitative  evaluation  of  several  advanced  drive 
system  concepts  for  on-condition  operation 

(3)  The  effect  of  stress  allowables  on  fatigue  life 

(4)  The  design  criteria  for  fail-safe  transmissions 

(5)  State-of-the-art  considerations  for  on-condition 
design 

Items  1  and  2,  dealing  with  advanced  design  concepts  and  com¬ 
ponent  improvement,  are  closely  interrelated;  consequently, 
they  are  discussed  in  a  mutual  framework  (and  make  up  the  main 
part  of  this  appendix) . 

Summary  of  Design  Considerations 

This  appendix  is  intended  to  emphasize  those  areas  of  design 
that  could  possibly  limit  TBO  extension  or  removal.  The  dual 
issues  of  failure  consequence  and  hazard  function  shape  are 
the  prime  concerns.  In  instances  where  a  B  greater  than  1 
might  be  present,  the  designer  must  assure  that  the  assembly 
is  tolerant  of  failure,  that  is,  the  consequence  must  not  be 
an  undetected  functional  failure.  If  safety  concerns  can  be 
eliminated  from  any  failure  mode,  a  3  greater  than  1  might  be 
tolerated. 

Those  associated  with  the  design  of  a  transmission  have,  of 
course,  a  responsibility  to  minimize  the  frequency  and  effects 
of  all  modes,  independent  of  where  they  occur  during  the  life 
of  the  transmission.  Achievement  of  this  objective  will  pro¬ 
duce  reliable  and  safe  aircraft.  The  importance  and  value  of 
these  efforts  is  not  diluted  by  suggesting  that  special  atten¬ 
tion  must  be  directed  at  certain  modes.  It  is  simply  the  hon¬ 
est  recognition  that  designers  and  the  design  process  are  not 
perfect,  and  unexpected  failures  will  occur.  These  failures 
need  not  limit  TBO  extension  or  removal  even  if  an  increasing 
failure  rate  with  time  (8>1)  exists,  as  long  as  its  conse¬ 
quences  are  not  serious. 
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The  proper  role  for  diagnostics  or  condition  monitoring  in  the 
TBO  question  is  clear.  These  devices  or  systems  contribute  to 
an  on-condition  status  by  removing  failure  modes  from  a  safety 
arena  and  thereby  increasing  the  acceptability  of  B>1.  In  the 
justifiable  desire  to  ease  maintenance  troubleshooting  and 
reduce  component  damage,  we  sometimes  overlook  the  fact  that 
diagnostics  do  not  change  the  frequency  of  occurrence  or  the 
shape  of  the  distribution.  Providing  a  30-minute  warning  of 
a  bearing  failure  does  not  alter  the  shape  }f  the  hazard  func¬ 
tion  for  that  bearing. 

In  this  light,  it  might  be  concluded  that  the  historical 
emphasis  on  diagnostics  is  inappropriate.  Instead  of  efforts 
to  increase  the  detectability  of  bearings  (which  have  gener¬ 
ally  constant  failure  rates:  3=1),  the  real  need  is  to  de¬ 
tect  potentially  catastrophic  failure  modes  that  have  shown  a 
propensity  to  high  3's  (e.g.,  low-cycle  fatigue-sensitive 
internal  structure  such  as  supports  or  shafts) .  The  dual 
objectives  for  diagnostics  of  minimum  maintenance/costs  and 
improved  safety  are  not  mutually  satisfying.  Clearly,  spe¬ 
cific  objectives  must  be  defined.  Appendix  III  of  this  report 
is  a  step  toward  the  development  of  the  role  of  diagnostics 
in  an  on-condition  evaluation. 


TRANSMISSION  ADVANCED  DESIGN  CONCEPTS 


It  is  appropriate  to  distinguish  between  transmission  compo¬ 
nent/element  improvements  and  improved  transmission  design 
concepts . 

o  Component  Improvements 

Component  improvements  involve  advanced  technology 
including  metallurgical,  gear  geometry,  contact 
ratio,  lubrication,  high-speed  tapered  roller 
bearing,  forged  gear,  and  like  improvements.  Failure 
data  for  these  improvements  do  not  exist  in  sufficient 
quantity.  Lead  tests  have  been  successfully  conducted, 
and  are  continuing  at  this  writing. 

o  Advanced  Transmission  Design  Concepts 

Advanced  transmission  design  concepts  include 
roller  gear  transmissions,  nutating  cMaroth) 
drive  transmissions,  split-power  (srlit-torque) 
transmissions,  lubricant-sealed  intjgral  trans- 
r  xssions,  modularized  transmissions,  gas-cycle 
(no  mechanical  element)  drives,  cyclo-drive 
transmissions,  harmonic-drive  transmissions,  and 
other  epicyclic  and  nonepicyclic  drive  systems. 

Many  variations  and/or  combinations  of  these 
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concepts  have  been  conceived  but  few  tests  have 
been  conducted  to  indicate  conclusive  superiority 
(as  a  power  transmitting  system)  in  terms  of  per¬ 
formance  or  weight-to-power  ratio.  Still  less  has 
been  done  to  derive  failure  data  and  associated 
confidence  levels. 

Projected  Applications  of  Advanced  Concepts 

In  general,  while  improved  transmission  compenent/element 
designs  are  applicable  to  all  gearbox-type  drive  systems, 
advanced  design  concepts  of  transmission  types  have  their 
applicability  on  a  selective  basis. 


1.  TRANSMISSION  COMPONENT  IMPROVEMENTS 


Because  of  the  lubricant/coolant  environment  required 
in  a  gearbox,  the  main  elements  are  generally  designed 
to  parameters  which  ensure  unlimited  life  for  gears  end 
safe  life  for  bearings.  In  the  meantime,  fail  safe 
concepts  for  gear/bearing  elements  are  being  pursued 
in  lead  tests  for  both  lubricated  and  nonlubricated 
operation. 

a.  Metallurgical  Advances: 

(1)  VASC0-X2  steels  for  gears  which  promise  to  raise 
the  threshold  for  fatigue  failure. 

(2)  M-50  steels  for  rolling  element  bearings  which 
promise  to  increase  B^g  life  through  improved 
load-carrying  capability. 

(3)  Precision  forged  gears  which  may  lead  to 
superior  metallurgical  grain  flow  to  as- 
machined  gears  thus  improving  load-carrying 
capability  and  resistance  to  surface  fat;jue. 
Rotating  load  tests  have  yet  to  be  conducted. 


b .  Gear  Geometry  Developments 

(1)  High  Contact  Ratio  (HCR)  Gears 

The  profile  contact  ratio  for  standard  spur  gear¬ 
ing  is  generally  in  the  range  of  1.3  to  1.5,  that 
is,  t  'o  pairs  of  teeth  share  the  load  at  the  en¬ 
trance  and  exit  points  of  the  mesh  cycle  while 
only  a  single  tooth  pair  carries  the  full  load 
during  the  remainder  of  the  cycle.  In  contrast, 
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high  contact  ratio  gears  (Figure  26) ,  with  pro¬ 
file  contact  ratio  2.  2.0,  share  the  load  among 
three  tooth  pairs  during  entrance  and  exit  while 
two  tooth  pairs  share  the  load  during  the  remain¬ 
der  of  the  cycle.  The  improved  load  sharing  of 
HCR  gearing  results  in  a  quieter,  smoother  oper¬ 
ating  system  with  increased  load  capacity. 

One  drawback  to  the  HCR  gear  is  the  rise  in 
sliding  friction  presented  by  increasing  the 
number  of  teeth  always  in  contact.  However,  the 
significant  reductions  in  per-tooth  loads  result¬ 
ing  from  improved  load  showing  results  in  a  net 
improvement  in  gear  scoring  resistance  and  gear 
fatigue  life. 

(2)  Noninvolute  Tooth  Form 


The  surface  load  capacity  of  a  gear  set  is  re¬ 
lated  to  its  relative  radius  of  curvature  at  the 
most  critical  load  position.  The  relative  radius 
of  curvature  varies  drastically  along  the  active 
profile  of  a  standard  involute  gear  set,  often 
by  a  factor  of  2  or  more.  In  order  to  maximize 
the  surface  load  capacity  of  spur  gearing,  the 
basic  kinematic  and  geometric  equations  defining 
their  conjugate  action  may  be  resolved  with  the 
additional  constraint  of  maintaining  a  constant 
relative  radius  of  curvature.  If  this  is  done, 
the  resulting  tooth  form  is  visually  quite  sim¬ 
ilar  to  an  involute  and  may  be  manufactured  and 
inspected  on  existing  i. -volute  gearing  machinery. 
The  resulting  profile,  by  virtue  of  its  constant 
curvature  shows  potential  for  increased  surface 
load  capability,  thus  improving  system  reliability 
through  a  reduction  of  gear  scoring  hazard  and  an 
increase  in  resistance  to  bending  fatigue 
failures . 

c .  Advancad  Lubricant  Development (s) 

At  least  two  candidate  lubricants  (Navy  Spec.  XAS-2354 
and  USAF  Spec.  MIL-L-27502)  show  promise  in  test  stages 
to  be  superior  to  MIL-L-7808  and  MIL-L-23699  oils  in 
terms  of  improved  load-carrying  capability  and  high 
resistance  to  nonoptimum  operating  conditions.  Eval¬ 
uations  of  performance  of  these  oils  in  a  host  trans¬ 
mission  are  being  planned.  If  successful,  they  will 
be  especially  useful  in  the  development  of  lubricant- 
seal  integral  transmissions. 
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POINTS  OF  CONTACT 


STANDARD  INVOLUTE 
GEARS 


HIGH  CONTACT 
RATIO  GEARS 


PRESSURE  ANGLE 
CONTACT  RATIO 
TRANSMITTED  TORQUE 
BENDING  STRESS 
CONTACT  STRESS 


25°  21° 

1.38  MIN  2.20 

133,624  IN.-LB 
49,916  PSI  41,609  PSI 

192,000  PSI  162,000  PSI 


Figure  26.  High-Contact-Ratio  Gears 
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d.  Tapered  Roller  Bearings 


» 


A  number  of  transmission  studies  have  revealed  that 
high-speed  {over  10,000  fpm)  tapered  roller  bearings 
offer  great  potential  for  increased  load  capacity  and 
bearing  life,  and  a  corresponding  reduction  in  bearing 
size  and  weight,  as  compared  to  a  system  of  ball  and 
cylindrical  roller  bearings. 

One  such  design  study  was  made  on  a  CH-47C  engine 
ncse  transmission.  The  standard  design  is  shown  in 
Figure  27.  The  goal  of  this  study  was  to  increase  the 
single  engine  power  from  2200  horsepower  to  3750  horse¬ 
power  and  provide  a  growth  potential  to  4500  horse¬ 
power  within  the  same  envelope  size.  One  facet  of  the 
study  revealed  five  basic  requirements  for  the  bearing 
system  in  order  to  achieve  this  goal: 

o  Reduce  centrifugal  force  on  rolling  elements 

o  Reduce  number  of  bearings  in  system 

o  Reduce  internal  heat  generation 

o  Increase  bearing  system  reliability 

o  Increase  system  stiffness 

o  Increase  operating  efficiency 

The  standard  engine  nose  transmission  was  redesigned 
by  incorporating  four  tapered  roller  bearings  in  place 
of  the  two  ball  and  four  roller  bearings.  A  detailed 
analysis  of  the  advanced  tapered  roller  system  design 
(as  compared  to  the  standard  design)  revealed  a  5- 
pound  weight  savings,  a  33-percent  increase  in  system 
reliability,  a  20-percent  reduction  in  friction  power 
loss  and  a  fourfold  improvement  in  radial  stiffness. 
Figure  28  shows  the  advanced  design,  and  Table  V 
shows  its  advantages  over  the  standard  design. 

e.  Grease  Lubrication 


Grease  lubrication  has  been  accepted  in  transmission 
elements  even  when  running  at  high  speeds  where  the 
grease  acts  as  a  lubricant  (as  opposed  to  lubricant/ 
coolant).  Here  fore,  greases  have  generally  been 
excluded  in  gearboxes  where  heat  must  be  dissipated, 
and  the  lubricant  must  perform  the  double  role  of 
lubricant  and  coolant.  As  a  lubricant,  grease  has 
previously  been  limited  on  helicopter  drive  systems 
almost  exclusively  to  shaft  support  bearings. 
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Figure  28.  Modified  Turboshaft  Engine  r?  -  on  Tapered 


TABLE  V.  COMPARATIVE  DESIGN  STUDY  OF  BALL/ROLLER 
BEARING  VERSUS  TAPERED  ROLLER  BEARING 


Parameter 

Current 

Technology 

Advanced 

Technology 

Configuration 

SK20308 

SK20548 

Number  of  Bearings 

2  Ball  and 

4  Roller 

4  Tapered  Roller 

Bearing  Weight  (lb) 

26 

21 

System  Reliability 

Baseline 

33%  Increase 

Friction  Losses 

Baseline 

20%  Reduction 

System  Stiffness 

Axial  -  Kx  (lb/in.) 

2.12  x  106 

2.66  x  106 

Radial  -  I' 3  (lb/in.) 

2.07  x  106 

8.02  x  106 

Moment  -  K  (lb-in. /rad) 

3.73  x  107 

8.25  x  107 

Late  developments  by  at  least  one  aerospace  company 
include  the  successful  use  of  grease  lubrication  in  a 
high-speed  (input)  section  of  a  rotor  transmission 
gearbox.  If  subsequent  testing  proves  successful,  it 
is  possible  that  grease  lubricants  may  qualify  as  a 
candidate  lubricant  for  lubricant-sealed  integral 
transmissions . 

Due  to  the  manner  in  which  grease  adheres  to  the 
bearings  and  gears,  its  use  is  extremely  attractive 
from  both  safety  and  survivability  aspects  since  it 
essentially  eliminates  lubrication  starvation. 


ADVANCED  TRANSMISSION  DESIGN  CONCEPTS 

On  a  selective  basis,  the  various  advanced  transmission 
designs  find  their  applicability  in  various  drive  systems 
only  after  vehicular  constraints  and  trade  studies  are 
defined.  For  an  air  vehicle  system,  the  relatively  high 
weight-to-power  ratio  has  focused  attention  on  the  effi¬ 
ciency  of  candidate  transmission  types  in  the  trade-study/ 
decision  process.  In  general,  the  number  of  gear  meshes 
from  the  prime-mover  (s)  (engines)  to  the  absorbers) 
(rotor/props)  is  a  direct  indication  of  system  efficiency. 
Epicyclic  (planetary)  gear  trains  are  generally  more  effi¬ 
cient  than  nonepicyclic  gear  trains. 

a.  Roller  Gear  Transmission 

The  roller  gear  concept  is  presently  undergoing  lead 
tests.  The  concept  can  be  in  a  fixed  or  free  "planet" 
configuration.  In  the  free  planet  configuration,  the 
planet  sets  are  in  an  epicyclic  mode  of  precession. 

The  main  feature  of  the  system  is  the  elimination  of 
the  planet  bearings  by  substituting  gear-integral 
torus  rings  that  radially  contact  mating  gears  at  the 
pitch  lines.  The  gears  are  matched  (paired)  helical 
sets  with  opposite  helices  which  obviate  the  necessity 
of  thrust  bearings.  The  disadvantages  include  the 
precision  of  manufacture  required  and  means  of  assem¬ 
bly  which  may  approach  torsional  "tuning"  of  the  sys¬ 
tem  elements  and  generate  a  requirement  for  signifi¬ 
cant  increases  in  quality  control  tolerance  levels. 

The  design  can  give  high  ratios,  and  in  general 
approaches  a  "pancake"  design  of  large  diameter  and 
shallow  height  which  has  value  from  the  aspect  of 
survivability . 


Many  forms  of  the  split-power  transmission  exist.  A 


Figure  29.  Split-Power  Transmission. 
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igure  30.  Basic  Cons tiruction  of  a  Cyclo— Drive  Transmission. 


Model  of  the  Mutating  (Marofch)  Drive  Principle 


bearings  need  to  be  assessed  for  a  projection  of 
system  reliability. 

i 

f .  Gas-Cycle  (No  Mechanical  Element)  Drive 

Many  studies  have  been  made  of  hot-cycle,  warm-cycle, 
and  cold-cycle  drives.  To  date,  high  fuel  require¬ 
ments  and  low  overall  efficiency  have  made  this  mode 
of  power  transmission  unsuitable  for  aircraft  use. 

g.  Modularized  Transmission  (Figures  32  through  35) 

This  transmission  concept  is  a  carryover  from  the 
"throwaway”  concept  of  maintenance.  Reliability  ar.d 
maintainability  can  sometimes  be  opposing  concepts; 
it  is  a  well-known  fact  that  maintenance  generates 
maintenance.  The  modularization  principle  recognizes 
that  parts  do  fail  (especially  systems  that  contain 
limited-life  parts) .  The  objective  of  such  modulari¬ 
zation  is  the  partitioning  of  subsystems  and  elements 
in' a  macro-system  in  a  way  that  will  facilitate  heavy 
servicing  and  maintenance  of  well-identified  limited- 
life  components.  Most  aircraft  systems  presently  in¬ 
corporate  some  modularization;  the  "new"  emphasis  is 
toward  optimization. 

h.  Lubricant-Sealed  Integral  Transmission 

Power  loss  in  transmission  systems  manifests  itself  as 
parasitical  heat  which  must  be  rejected.  This  is  con¬ 
ventionally  done  by  ducting  the  lubricant/coolant  oil 
to  a  heat  exchanger  and  blowing  the  heat  overboard. 

The  heat-exchanger/fan  system  is  usually  remote  from 
the  gearbox;  together  with  ;its  oil  lines,  it  has  been 
identified  as  the  single  most  vulnerable  subsystem  in 
the  helicopter  drive  system.  A  .lubricant-sealed 
integral  transmission  would  obviate  the  necessity  for 
external  oil  lines  and  would  therefore  be  less  vulner¬ 
able  to  oil  loss  from  any  cause.  First  steps  have 
been  taken  in  the  direction  of  this  development.  Near- 
term  new  designs  include  an  integral  oil  cooler/fan 
system  contiguous  to  the  host  transmission  it  serves. 
The  heat  exchanger  and  fan  are  external  to  the  trans¬ 
mission,  but  long  external  lines  have  been  eliminated. 
The  next-generation  approach  to  a  self-contained  lu¬ 
bricated  transmission  is  in  the  planning  stages. 

Thermal  mapping  tests  have  been  conducted  to  determine 
the  temperatures  of  all  main  elements  in  the  trans¬ 
mission.  The  tests  (together  with  the  search  for 
superior  high- temperature  oils)  were  planned  to  indi¬ 
cate  the  relative  tolerance  of  a  transmission  to  use 
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re  32.  Cu-47C  Aft  Transmission  Cross  Section. 
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BEVEL  GEAR  MODULE  BLOWER 
SUMP.  PUMP.  COOLER  AND  FILTER 


SUMP  AND  FILTER 


Figure  34.  Modularized  Transmission  With  Integral  Module 
Lubrication. 


90 


VERTICAL  SHAFT  MODULE 


INPUT  PINION  MODULE 


QUILL  SHAFT 
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ACCESSORY  DRIVE  MODULE 


MAIN  SUMP  MODULE 


Figure  35,  Modularized  Transmission  With  Multi-Module 
Lubrication. 
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elevated  temperatures  for  both  continuous  and  emer¬ 
gency  operation. 

1.  Effect  of  Nev/  Design  Concepts  and  Component 
Improvement  or  On-Condition  Operation 

On-condition  maintainance  is  based  upon  existing 
operational  fleets.  Much  data  exists  on  these  exist¬ 
ing  transmissions  and  drive  systems.  The  application 
of  on-condition  practices  in  early  design  and  feasi¬ 
bility  studies  of  nev;  concepts  is  a  necessary  goal  in 
any  true  systems  engineering  effort.  Achievement  of 
this  goal  will  be  evaluated  by  trade  studies  made  with 
the  assumption  development,  and/or  use  of  mathematical 
models  (reference  Appendix  I)  that  simulate  the  design 
process.  In  this  regard,  the  dominating  (and  some¬ 
times  transient)  modes  of  failure  must  be  clearly 
identified.  Matrices  for  the  identification  of  modes 
of  failure  of  transmission  components  are  identified 
in  Appendix  VIII.  These  modes  of  failure  are  identi¬ 
fied  for  normal  lubricated  operation.  Except  for  load 
tests,  statistical  modes  of  failure  for  non-lube  oper¬ 
ation  do  not  exist  for  helicopter  transmissions. 

Based  upon  these  non-lube  tests  it  has  been  possible 
to  hypothesize  the  fundamental  relationship  that 
exists  between  dry-running-time-to-failure  and  compo¬ 
nent  design  parameters  such  as  speed,  load,  and  size, 
for  bearings  and  gears.  The  mathematical  models  de¬ 
rived  are  discussed  under  the  fail-safe  design  cri¬ 
teria  topic  of  this  appendix. 

(1)  Risk  Assessment  of  New  Design  Concepts 

(a)  Component  and  Element  Advances 

A  low  risk  is  assigned  to  all  aforementioned 
advanced  elemental  and  component  concepts. 

A  single  exception  may  be  non- lube  element 
designs;  however,  their  eventual  development 
for  emergency  operation  remains  probable 
even  if  at  a  moderate  risk  level. 

( b )  Advanced  Transmission  Designs 

Assignment  of  low  risk  is  given  tc  split- 
power,  harmonic,  cycloidal,  modularized,  and 
lubricant-sealed  integral  transmission  drive 
systems.  A  moderate  risk  is  assigned  to  the 
roller  gear,  and  nutating  (Maroth)  drive. 
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(2)  Impact  of  New  Design  Concepts  on  On-Condition 
Capability  "" 

Three  of  the  new  design  concepts  identified  in 
this  section  warrant  additional  discussion  due 
to  their  impact  upon  on-condition  capability. 
These  designs  are  the  roller  gear  drive,  modu¬ 
larized  transmission,  and  lubricant-sealed 
integral  transmission. 

(a)  Roller  Gear  Drive 


Theoretically,  this  concept  offers  great 
promise  for  on-condition  operation,  due  to 
the  elimination  of  thrust  bearings  by  use 
of  gear-integral  torus  rings  that  radially 
contact  mating  gears.  Thus,  the  high  re  ■  .  - 
ability  generally  exhibited  by  gears  rep  -oes 
the  relatively  low  reliability  of  thrust 
bearings . 

Furthermore,  applications  of  component/ 
element  advances  such  as  VASCO-X  steel  and 
improved  lubricants,  when  coupled  with  the 
roller  gear  drive  concept,  present  an  even 
more  favorable  outlook  for  on-condition 
transmission  operation. 

One  point  of  concern  does  exist  regarding 
the  roller  gear  drive.  This  is  the  EB-weld 
generally  employed  to  unite  the  gear  to  the 
shaft.  The  acceptable  performance  of  this 
weld  in  the  high  time  regimes  required  for 
on-condition  maintenance,  as  yet  unproven, 
is  of  some  concern  since  failure  of  this 
weld  could  be  potentially  catastrophic  and 
possibly  undetectable. 

However,  it  is  anticipated  that  a  resolution 
of  this  problem  is  within  the  state-of-the- 
art  either  due  to  demonstration  of  existing 
capability  of  EB-welds  or  advancements  in 
welding  techniques. 

Thus,  the  roller-gear  drive  appears  to  be  a 
good  candidate  for  on-condition  operation. 

(b)  Modularized  Transmission 


This  concept  enhances  on-conditior.  potential 
in  two  aspects:  (1)  by  offering  a  manner  of 
removing  failed  parts  without  removing  total 


93 


assemblies/  and  (2)  by  allowing  on- 
condition  operation  for  gearboxes  having 
certain  life-limited  parts.  The  justifi¬ 
cation  of  these  statements  appears  in  the 
following  paragraphs. 

For  the  CH-47,  a  large  percentage  of  un¬ 
scheduled  transmission  removals  has  con¬ 
tained  only  one  failed  item  (Figure  36) . 
Furthermore,  in  those  boxes  where  more  than 
one  failed  item  was  found,  a  high  percentage 
had  all  their  failed  items  in  a  physically 
localized  area  (e.g.,  area  of  planetary 
assemblies) .  This  reflects  the  progression 
of  an  initial  failure  to  the  point  of  caus¬ 
ing  secondary  damage  to  those  parts  in 
relative  proximity.  Modularization  should 
allow  the  field  repair  of  a  large  percentage 
of  failed  transmissions  through  replacement 
of  only  one  module  of  •‘'he  assembly. 

Again  for  the  CH-47,  all  of  the  currently 
life-limited  transmission  parts  in  the  1200- 
hour  domain  are  in  a  fairly  localized  area. 

In  the  forward  and  aft  gearboxes,  the  first 
and  second  stage  planet  gear/bearing  assem¬ 
blies  (114DS281  and  114DS282,  respectively) 
and  the  second  stage  carrier  support  bearing 
(114DS250)  are  the  only  parts  in  this  1200- 
hour  domain.  All  others  are  above  1900  hours 
(Table  VI) .  Thus,  a  modularized  design 
which  permits  the  removal  of  both  planet 
assemblies  as  one  module  could  allow  an  in¬ 
crease  in  TBO  from  1200  to  1900  hours  for 
the  remaining  module (s).  For  transmissions 
prevented  from  operating  "on-condition"  by 
one  or  two  parts,  it  may  be  possible  to  have 
a  time-phased  removal  of  a  module  containing 
these  parts,  thus  rendering  the  remainuer  of 
the  transmission  "on-condition". 

Finally,  it  should  be  noted  that  the  devel¬ 
opment  of  an  adequate  modularization  scheme 
is  a  complex  task.  It  is  recognized  that 
casual  modularization  can  be  detrimental  to 
transmission  reliability.  Since  the  modu¬ 
larization  concept  can  only  become  a  reality 
through  the  efficient  exercise  of  design  and 
maintainability  practices,  it  must  preclude 
any  requirement  for  excessively  meticulous 
shimming  or  adjustments,  which  would  be  un¬ 
reasonable  at  the  Army  organizational  mainte¬ 
nance  level. 
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Figure  36.  Distribution  of  CH-47  Failures  per  Transmission 
Removal  (Showing  Percentage  of  Removals 
Containing  Only  One  Failure). 
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TABLE  VI.  CH-47  TRANSMISSION  LIFE -LIMITED  PARTS 


(c)  Lubricant-Sealed  Integral  Transmission 


The  concept  of  the  lubricant-sealed  integral 
transmission  has  as  its  ultimate  goal  the 
elimination  of  presently  necessary  cooling 
and  pressurizing  components  outside  the 
transmission  boundary.  Intermediate  steps 
to  this  all-radiation/natural-convecticn- 
cooled  transmission  include  present  fan  and 
cooler  integral  transmissions  (fan  and 
cooler  contiguous  to  the  transmission 
boundary)  and  modularized  forms.  The  ex¬ 
treme  form  of  a  lubricant-sealed  integral 
transmission  is  a  sealed-for-lif e  trans¬ 
mission. 

For  the  sealed-for-life  transmission,  on- 
condition  operation  as  a  unit  is  a  neces¬ 
sity.  Since  the  gearbox  may  be  sealed  upon 
assembly,  it  should  be  designed  for  extended 
life  and  on-condition  unit  operation  in 
order  to  be  cost  effective.  All  design 
practices  should  be  slanted  toward  the  de¬ 
velopment  of  a  transmission  which  has  a  high 
MTBR .  If  the  lubricant-sealed  integral 
transmission  is  sealed  for  life,  it  may  not 
be  repairable  since  the  inherent  design  con¬ 
cept  may  negate  the  potential  for  disassem¬ 
bly  and  overhaul. 

Thus,  in  order  to  achieve  this  high  level  of 
MTBR,  the  proponents  of  this  design  concept 
intend  to  employ  several  component/element 
advances.  First,  VASC0-X2  steel  will  be  em¬ 
ployed  for  all  gears  and  M-50  steel  will  be 
employed  for  all  bearings.  Thus,  a  signifi¬ 
cant  increase  in  MTBR  due  to  improved  bearing 
and  gear  fatigue  lives  is  expected. 

Second,  it  is  intended  that  improved  low- 
load  testing  will  be  employed  to  reduce  the 
potential  for  infant  mortality.  The  low- 
load  (green-run)  testing  may  be  made  in 
increments  accumulating  in  the  order  of  24 
hours  of  test  time,  as  compared  to  present 
3-hour  runs.  Upon  completion  of  the  test,  a 
complete  flushing  of  the  transmission  will 
eliminate  any  debris  resulting  from  prior 
faorication  and  processing. 

Third,  new  and  improved  lubricants  will  be 
employed  (such  as  MIL-L-27502,  U.S.  Navy 
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experimental  XAS-2354  candidates,  and  others 
presently  being  tested)  with  significantly 
better  load  carrying  and  higher  temperature 
tolerance  characteristics  than  present 
lubricants . 

Fourth,  advanced  gear  geometry  will  be  used 
to  provide  high  contact  ratios  which  may  give 
quantum  improvement  in  gear  fatigue  lives. 

Fifth,  and  possibly  most  significant  from  an 
on-condition  aspect,  the  inherent  design 
philosophy  is  such  that  a  significant  reduc¬ 
tion  in  retention  and  mounting  hardware  may 
take  place.  This  is  of  great  importance 
since,  as  Appendix  VIII  shows,  a  large  per¬ 
centage  of  all  transmission  failures  fall  into 
this  category. 

It  should  be  noted  that  the  application  of 
the  first  four  points  above  (and  possibly 
the  fifth)  are  not  unique  to  sealed  trans¬ 
missions.  The  comment  regarding  these 
points  is  that  their  application  on  the 
sealed-for-life  transmission  is  considered 
a  virtual  necessity,  not  a  luxury.  If  the 
transmission  design  specialists  intend  to 
make  this  concept  a  reality,  these  techniques 
must  be  employed,  and  thus  the  lubricant 
sealed  integral  transmission  appears  a  viable 
approach  to  on-condition  maintenance. 


RELATION  OF  FATIGUE  FAILURES  TO  STRESS  ALLOWABLES 


It  is  essential  to  on-condition  operation  tnat  components 
have  fatigue  lives  that  allow  safe  operation  in  the  5000- 
hour  regime.  Numerous  parameters  must  be  considered  in 
evaluating  the  effect  of  alternating  stress  fatigue  upon 
component  safe  life.  Typically,  the  major  parameters  of 
concern  are: 

Surface  finish 
Size  effect 
Fretting 
Corrosion 

Nonmetallic  inclusions 
Grain  direction 
Decarburization 
Residual  stresses 
Speed  cf  testing 
Steady  loads 
Component  shape 
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Various  design  criteria  related  to  these  eleven  parameters 
are  identified  in  the  following  paragraphs. 

a.  Surface  Finish 


The  effect  of  surface  finish  on  fatigue  allowables  is 
important  but  should  not  be  overemphasised  since  other 
effects  suc.h  as  surface  stress  condition  may  be  much 
more  important.  Several  design  criteria  are: 

(1)  No  highly  stressed  dynamic  components  should  have 
a  surface  finish  greater  than  125^. 

(2)  In  extremely  critical  areas,  finer  finishes  are 
recommended  to  lessen  the  possibilities  of 
machining  tears. 

(3)  Finishes  up  to  250 /”  may  be  permitted  in  low 
stress  areas  if  grit  blasting  is  used  sub¬ 
sequently. 

b.  Size  Effect 


The  effect  of  size  on  fatigue  strengch  has  produced 
^reat  consternation  among  fatigue  investigators.  The 
■eason  is  that  the  number  of  test  data  points  is 
usually  small  and,  therefore,  subject  to  questions  of 
whether  or  not  scatter  due  to  some  other  variable  is 
responsible  for  the  apparent  variations. 

WADC  Technical  Report  59-230,  "Qualitative  Aspects  of 
Fatigue  of  Materials,"  by  H.  Cummings  identifies  a 
definite  decrease  in  fatigue  strength  with  increased 
specimen  size. 

This  is  explained  by  the  "weakest  link"  theory  (i.e., 
the  chance  effects  of  finding  weaker  constituents  in 
the  high  stressed  zones  is  increased  because  of  the 
size  of  the  member).  However,  this  factor  is  almost 
negated  by  advances  in  technology  resulting  in  clean 
(almost  inclusion-free)  materials. 

c.  Fretting 

Whenever  two  surfaces  of  any  material  are  placed  in 
contact  with  each  other  and  subjected  to  the  slightest 
relative  movement,  even  though  the  movement  is  micro¬ 
scopic,  a  special  form  of  corrosion  may  take  place. 
This  corrosion  makes  itself  evident  by  the  appearance 
of  irregular  patches  of  oxide  which  will  begin  to 
develop  even  under  very  low  pressures  and  within  the 
first  half  cycle  of  movement. 
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Fretting  corrosion  is  primarily  of  mechanical  rather 
than  chemical  nature.  Although  fretting  does  not 
occur  when  no  motion  takes  place,  it  can  occur  with 
small  relative  motions  of  the  order  of  molecular 
dimensions . 

One  theory  which  states  that  "molecular  effects  and 
forces  are  at  the  root  of  fretting  corrosion"  holds 
that  direct  oxidation  of  the  surface  is  a  result  of 
high  local  heat  from  severance  of  cohesion  bonds  be¬ 
tween  the  surface  molecules. 

Some  general  solutions  to  fretting  are: 

(1)  Elimination  or  exclusion  of  oxygen  at  con¬ 
tact  surfaces 

(2)  Provision  of  an  adequate  lubricant  or  surface 
coating  to  reduce  friction 

(3)  Provision  of  a  plated  or  treated  surface  to 
prevent  or  minimize  relative  motion  between 
mating  surfaces 

(4)  Provision  of  a  gasket  to  absorb  motion 
without  metal  pickup  or  welding 

(5)  Increase  the  hardness  of  one  or  both  surfaces 

(6)  Induce  residual  compressive  stresses  at  the 
contact  surfaces  through  shot  peening,  surface 
rolling,  nitriding,  or  carburizing 

Since  fretting  causes  a  significant  reduction  in 
fatigue  strength,  a  fretting  fatigue  strength  reduc¬ 
tion  factor  should  be  used.  A  value  of  2  is  frequently 
employed . 

d.  Corrosion 


Experience  has  shown  that  corrosion  significantly  re¬ 
duces  the  fatigue  strength  if  the  corrosion  occurs 
while  the  item  is  being  stressed.  For  items  corroded 
but  stressed  dry,  the  reduction  is  not  great  unless 
significant  corrosion  pits  have  occurred  to  produce 
severe  stress  raisers. 

Corrosion  is  a  chemical  and  electrochemical  phenomenon. 
One,  or  more  likely,  bon  occur  under  the  usual  fatigue 
stressing  conditions.  Even  under  static  tensile  stres¬ 
sing  corrosion  proceeds  faster  (in  corrodible  metals) 
than  when  they  are  unstressed.  Moreover,  many  metals 
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corrode  in  air,  provided  it  is  not  absolutely  dry.  It 
is  possible  that  corrosion  fatigue  is  to  be  expected, 
in  some  degree,  wherever  cyclic  stressing  exists. 
Protecting  the  surface  from  contact  with  the  air  re¬ 
sults  in  better  fatigue  properties,  presumably  because 
corrosion  is  inhibited  by  a  covering  of  oil. 

e .  Nonmetallic  Inclusions  (Stringers) 

Nonmetallic  inclusions  in  the  material  can  be  harmful, 
depending  on  the  location  and  orientation  relative  to 
the  load  direction.  Inclusions  that  start  out  spheri¬ 
cal  in  shape,  say  0.0010  to  0.0060  inch  in  diameter, 
may  be  stretched  out  during  forging  to  hairline 
stringers  a  number  of  inches  in  length. 

The  direction  of  surface  stringers  can  be  established 
by  inspection  techniques  using  zyglo  or  magnaflux.  If 
the  load  is  parallel  to  the  stringer  direction,  there 
is  very  little  effect.  If  the  load  is  normal  to  the 
stringer  direction,  the  reduction  in  strength  can  be 
substantial,  depending  upon  the  length. 

Acceptable  stringer  lengths  and  intensities  vary  from 
component  to  component,  and  must  be  established 
uniquely  as  a  function  of  the  performance  requirements 
and  criticality  of  the  component. 

Inclusions  at  the  surface  can  sometimes  be  ground  out, 
but  if  the  steel  is  "dirty"  the  grinding  may  only  un¬ 
cover  more  stringers. 

If  inclusions  and  stringers  tend  to  become  a  problem 
in  a  specific  design,  air  melt  steel  may  be  replaced 
(at  increased  cost)  by  vacuum  melt  steel.  This  does 
not  improve  the  fatigue  strength  directly,  but  will 
reduce  the  probability  of  stringer  occurrence  and  the 
possibility  of  the  failure  originating  at  an  inclusion 
or  stringer.  This  is  demonstrated  in  Figure  37. 

f.  Grain  Direction 


Although  grain  flow  plays  an  important  part  in  the 
ultimate  strength  characteristics  of  a  material  (i.e.; 
longitudinal  versus  transverse) ,  the  effect  is  not  so 
pronounced  in  fatigue  applications.  Experience  has 
shown  that  the  difference  in  fatigue  strength  between 
longitudinal  and  transverse  directions  is  slight,  and 
does  not  require  consideration. 

However,  this  does  not  mean  that  proper  grain  flow 
should  not  be  specified  in  forgings,  because  the 
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possibility  of  nonmetallic  ,inr  usions  and  stringers 
still  exists. 

Several  conclusions  are  notable: 

(1)  Ultimate  failures  occur  primarily  at  grain 
boundary. 

(2)  Transverse  loading  encounters  more  grain 
boundary. 

(3)  Fatigue  failures  are  primarily  transverse. 

(4)  In  fatigue  applications  with  high  mean 
stresses  there  may  be  a  reduction  in  fatigue 
strength  similar  to  the  ultimate  condition. 

g.  Decarburization 


The  fatigue  strength  of  steel  can  be  greatly  reduced 
by  the  loss  of  carbon.  Decarburization  exists  on 
almost  all  forged  surfaces;  it  reduces  the  surface 
ultimate  tensile  strength  and  consequent} v  reduces 
fatigue  strength. 

Lipsitt  and  Horne  (in  an  ASTM  paper  on  "Fatigue  Be¬ 
havior  of  Decarburized  Steel")  present,  data  on  fatigue 
strength  reduction  of  decarburized  mild  steel.  Based 
on  some  75  specimens,  the  strength  reduction  factor 
varies  from  1.55  to  1.8.  For  higher  strength  steels, 
the  expected  reduction  may  be  greater. 

It  is  interesting  to  note  that  AN  bolts  permit  con¬ 
siderable  decarburization  while  fatigue  type  NAS  bolts 
have  tight  decarburization  control.  In  this  case  the 
allowable  ratio  is  almost  2  to  1  (however,  it  also 
includes  effects  of  larger  root  radius) . 

Present  design  practices  generally  require  that  all 
high  stressed  forged  surfaces  have  sufficient  material 
removed  so  that  all  decarburized  surfaces  are  removed. 
There  are  relatively  few  exceptions  to  this  rule.  The 
exceptions  are  usually  thoroughly  evaluated  by  fatigue 
testing. 

It  should  be  noted  that  there  are  processes  that  can 
be  utilized  to  restore  the  lost  carbon  and  thereby 
improve  the  fatigue  strength. 

h.  Residual  Stresses 


Residual  compression  stresses  will  invariably  increase 
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fatigue  strength,  especially  in  areas  of  high  stress 
concentration.  It  should  be  noted,  however,  that  in 
order  for  residual  compression  to  exist,  residual 
tension  must  also  exist  (to  provide  internal  equilib¬ 
rium  of  stress) . 

Numerous  methods  of  inducing  or  reducing  residual 
stresses  of  metals  exist  including  machining,  shot 
peening,  electro lizing,  chrome  plating,  and  chem- 
milling. 

Not  all  these  techniques  provide  an  increase  in 
fatigue  strength.  Notably,  electrolizing  (without 
simultaneous  wetting) aand  chrome  plating  (without 
previous  peening)  may  reduce  fatigue  strength.  These 
two  techniques  are  primarily  intended  to  increase 
wear  resistance. 

Conservative  design  practices  recommend  that  compo¬ 
nents  should  meet  their  fatigue  strength  requirements 
without  the  use  of  peening.  These  techniques  are  in¬ 
tended  for  application  only  as  a  means  of  providing 
additional  margins  against  failure. 

i.  Speed  of  Testing 

Tests  conducted  at  less  than  100,000  CPM  provide  small 
improvements  upon  fatigue  strength  of  most  steels  unless 
accompanied  by  considerable  heating  of  the  specimen. 

The  effect  of  testing  spued  is  discussed  in  greater 
detail  in  Appendix  IV  of  this  report. 

j .  Steady  Loads 

Fatigue  strength  can  be  affected  by  the  magnitude  of 
the  steady  loads  on  the  part,  as  well  as  the  oscillat¬ 
ing  loads.  (The  Goodman  curves  relating  steady  stress 
to  oscillating  stress  for  steels  can  be  found  in  MIL- 
HDBK-5 . )  It  should  be  noted,  however.-  that  fatigue 
failures  can  take  place  in  parts  subjected  to  com¬ 
pletely  compressive  steady  stresses. 

k .  Component  Shape 

Shape  is  known  to  affect  the  endurance  limit  of  com¬ 
ponents.  This  is  explained  by  the  susceptibility  to 
localized  inelastic  action,  which  is  a  function  of 
cross-section  shape.  It  is  further  hypothesized  that 
the  larger  the  volume  of  the  thin  surface  layer,  the 
higher  the  probability  that  it  will  contain  serious 
sore  spots. 
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1.  Re?  ation  of  S/N  Curves  to  Hazard  Functions 


Two  basic  assumptions  are  made  in  the  development  of 
S/N  curves: 

(1)  Stress  for  a  given  lire  is  distributed 
normal . 

(2)  Life  for  a  given  stress  is  distributed  log 
normal. 

The  second  of  these  assumptions  is  of  great  importance 
to  an  on-condition  analysis.  Mathematically,  this 
assumption  means  that 

R(t)  =  /  -pr~~  x-1  e"(ln  x  "  a)  /*2°2  dx 

o  *  air  a 


where  x,  a  >  o 
n 

a  =  (  l  In  Xj_ )  /n  =  mean 

i=l 

a  ~  =  standard  deviation 

( l  (In  X:  >  a)  2)/n 
i=l 


The  hazard  rate  of  the  log  normal  distribution  can  be 
calculated  using  the  follow  equation: 


H  ( t) 


=  £(t)  = 
R  (t) 


, — L_  t“l  e~  ( In  t~ct)2/.2*02 
a 


dt 


O  v/2rr 


-1  -(In  t-  a)  / .2  •  a" 
t  •  e 


As  in  the  case  of  the  normal  distribution,  this  equa¬ 
tion  for  hazard  rate  cannot  be  reduced  to  a  tractable 
form.  It  can  be  evaluated,  however,  by  using  normal 
tables  for  the  values  of  f(t)  and  R(t) . 

In  order  to  discuss  the  impact  of  the  assumption  of 
log  normality  upon  on-condition  capability,  Figure  38 
has  been  developed  to  show  the  similarity  of  the 
log-normal  distribution  to  the  Weibull  distribution. 
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Thus,  the  log-normal  hazard  rate  can  now  be  discussed 
in  the  same  manner  as  a  Weibull  distribution  with  the 
corresponding  g  and  0  parameters.  It  should  be  ap¬ 
parent  from  Figure  38,  that  for  times  in  excess  of 
10 7  cycles  (and  in  some  cases  a  significantly  lower 
number  of  cycles) ,  the  hazard  function  is  decreasing 
with  increasing  time  (i.e.,  0  is  less  than  1.0). 

This  should  be  of  no  surprise  to  those  familiar  with 
S/N  curvet-,  since  the  stress  man  generally  assumes 
that  the  S/N  curve  flattens  out  at  10 7  cycles.  In  the 
terminology  of  the  reliability  engineer,  "flattening 
of  the  S/N  curve"  means  that  the  cumulative  probabil¬ 
ity  of  failure  remains  constant  over  that  period  of 
time  when  the  S/N  curve  is  flat.  This  also  means  that 
during  the  flat  period,  the  hazard  rate  is  0. 

This  notion  of  a  zero  hazard  rate  is  unacceptable  to 
the  reliability  engineer.  In  the  case  of  a  log-normal 
distribution,  the  hazard  function  must  have  some 
finite  value  (albeit  small)  for  times  in  excess  of  107 
cycles.  However,  as  stated  above,  the  decreasing 
hazard  rate,  coupled  with  the  extremely  small  magni¬ 
tude  of  the  hazard  function,  supports  on-condition 
operation  from  the  standpoint  of  fatigue  life. 


4.  FAIL-SAFE  DESIGN  CONCEPTS 


Generally,  a  fail-safe  system  can  be  described  as  one 
which  can  sustain  a  partial  or  complete  failure  of  one  or 
more  of  its  components  but  still  perform  its  required 
functions.  The  technical  approaches  to  achieving  fail- 
safety  are  threefold: 

(1)  Load  path  redundancy 

(2)  Design  and  test  components  with  slow  failure 
progression  rates 

(3)  Incipient  failure  warning/inspection  systems 

Present- generation  helicopters  employ  these  techniques  to 
some  extent.  Fail-safe  drive  system  concepts  are  pre¬ 
sented  in  the  following  examples: 

a.  Load  Path  Redundancy 

(1)  Gears 


Because  of  the  angle  of  the  teeth  in  a  helical 
gear,  two  or  more  teeth  of  each  of  the  mating 
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gears  are  always  in  contact  simultaneously ,  thus 
providing  an  inherent  redundancy. 

A  mechanical  gap  which  interrupts  the  otherwise 
continuous  tooth  at  one  or  more  points  along  the 
gear  face  can  be  used  to  prevent  crack  progres¬ 
sion  across  the  entire  face.  An  example  of  this 
can  be  seen  in  the  Boeing-Vertol  Model  ] 07-11 
helicopter  first  stage  (high-speed  herringbone) 
reduction  gear. 

The  renewed  emphasis  on  high-contact-ratio  gears 
promises  to  add  multij.  le  load  path  redundancy  to 
otherwise  "straight"  spur  gears. 

Spiral  bevel  gears  can  be  considered  to  have 
inherent  load  path  redundancy,  since  they  are  the 
"equivalent"  of  helical  spur  gears  except  that 
power  is  distributed  through  an  angular-displaced 
plane . 

(2)  Shaft  Couplings 

The  multi-plate  flexible  couplings  on  synchro¬ 
nizing  shafts  allow  for  deflections  in  the  air¬ 
frame  without  damage  to  drive-line  components. 
Tests  have  demonstrated  that  the  failure  of  a 
limited  number  of  plates  in  the  coupling  pack  does 
not  destroy  the  load  carrying  capabilities  of 
this  component. 

(3)  Shaft  Coupling  Adapters 

Tests  and  field  experience  have  demonstrated  that 
these  adapters  are  capable  of  continuous  service 
even  after  the  complete  failure  of  one  lug  and  a 
partial  failure  of  another  where  three  or  more 
lugs  make  up  the  design.  Adapters  with  multiple 
rivets  and/or  spline  teeth  are  likewise  inherently 
redundant . 

Design  of  Components  with  Slow  Failure  Progression 
Rates 


( 1 )  Shaft  Couplings 

The  multiplicity  and  independence  of  coupling 
plates  previously  cited  also  greatly  retards 
failure  propagation  through  the  assembly. 


(2)  Shaft  Coupling  Adapters 

During  testing,  an  adapter  with  a  crack  continued 
functional  operation  after  25  flight  hours  with¬ 
out  appreciable  propagation.  On  the  assumption 
that  the  crack  might  eventually  progress  across 
the  entire  element,  a  cut  was  made  to  simulate 
lug  complete  failure.  No  subsequent  failure 
occurred. 

(3)  Bearings  and  Gears 

Failure  progression  rates  on  gears  and  bearings 
will  be  discussed  in  detail  in  Appendix  IV. 

c.  Incipient  Failure  Warning  and  Inspection  Systems 

This  subject  is  discussed  in  detail  in  Appendix  III  of 
this  report. 

d.  Current  Fail-Safe  Design  Evaluations 

Testing  is  under  way  on  various  transmission  designs 
and  components.  The  following  are  examples  of  addi¬ 
tional  work  in  progress  or  in  the  planning  stages: 

(1)  Rolling-Element  Bearings  -  Self-Lubrication 

Steps  should  be  taken  to  assure  that  bearings 
have  sufficient  dry  running  capability  to  enable 
the  pilot  to  take  corrective  action  (forced 
landinq,  abort,  etc.)  if  all  lubrication  is  lost. 
Figure  39  shows  a  relationship  developed  using 
historical  11—46 ,  H-47,  H-21,  and  H-25  data 
which  can  be  employed  to  estimate  bearing  dry 
running  time  to  failure.  It  is  recommended  that 
all  bearings  be  designed  to  survive  at  least  30 
minutes  without  lubrication.  If  this  is  not 
attainable,  backup  lubrication  must  be  provided 
to  critical  bearings. 

(2)  Drain-Back  Lubrication  of  Critical  Bearings 

Two  types  of  supply  of  drain  lubricant  were 
successful  in  permitting  a  high-speed  CH-47 
bevel  pinion  and  bearing  assembly  to  function  at 
tolerable  but  stabilized  temperatures,  thus  im¬ 
proving  the  resistance  to  catastrophic  bearing 
failures.  (See  Figure  40.) 
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TIME  TO  FAILURE  (MINUTES) 


Figure  39.  Dry  Lube  Bearing  Life  Criteria. 
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Figure  40.  Backup  Lube  System. 


( 3 )  Detection  of  Oil  Starvation  Condition  of 
Bearings 

To  date,  various  tests  have  indicated  that  a 
method  to  measure  inner  race  temperature  rise 
may  provide  some  advantage  in  failure  detection. 
It  was  evident  that  the  inner  race  temperature 
rise  preceded  the  outer  race  rise  by  as  much  as 
5  minutes  during  a  25-minute  run  to  failure 
(after  oil  supply  cut-off) .  Among  the  candidate 
oil  starvation  detection  concepts  were  two  jet 
flow  ground  checking  devices.  (See  Figure 
41.) 

( 4 )  Redundant  Design  Study  for  Bevel  Gear,  Shaft 
and/or  Bearing  Failure  with  Built-In  Warning 
System 

This  concept  employs  the  strategic  placement  of 
EBW,  fail-safe  shoulders,  and  encapsulated/ 
pressurized  shaft/gear  cavity  failure  warning 
agents  to  evaluate  seven  discrete  types  of  fail¬ 
ures  in  the  first  and  second  torque  distributing 
stages  (spiral  bevel  mesh  and  first  stags  sun)  of 
the  CH--47  rotor  transmissions.  (See  Figures 
42  and  43  and  the  Failure  Modes  Analysis,  Table 
VII.) 

( 5 )  Fail-Safe  Restraint  for  Planetary  Gear  Stage 
Component  Failure 

A  failure  modes  and  effects  analysis  and  subse¬ 
quent  testing  indicated  that  a  fail-safe  re¬ 
straint  against  loss  of  an  individual  planet  gear 
and  sun  gear  can  be  successfully  incoporated  in 
a  CH-46  type  rotor  transmission.  In  addition,  a 
simulated  fatigue  failure  of  a  planet  carrier  was 
tested.  This  test  showed  that  the  planet  carrier 
was  sufficiently  redundant  and  load  relieving  so 
that  the  fatigue  failure  did  not  progress.  (See 
Figures  44  through  46.) 

STATE-OF-THE-ART  CONSIDERATIONS  FOR  ON-CONDITION  DESIGN 


Designing  a  helicopter  transmission  to  be  operated  "on- 
condition"  requires  considerations  not  unlike  designing 
for  high  reliability.  However,  a  different  emphasis  must 
be  applied  to  certain  failure  modes:  modes  having  a  po¬ 
tentially  catastrophic  failure  progression  or  modes  having 
increasing  failure  rates  (6>1)  during  the  expected  life  of 
the  transmission  must  be  examined  very  critically. 


Figure  41.  Fxow-M 
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(Full  Scale). 


43.  CH-47C  Redundant  Ring  Gear  Design 


TABLE 

VII.  FAILURE  MODES  ANALYSIS  -  BEVEL  GEAR 

Failure  Mode 

Effect 

Results 

1.  Nut  back-off 

Ring  gear  is  axially  dis- 

1.  Flange  of  Part  #2  would 

{Part  #3) 

placed  but  restrained  by 

shear,  causing  an  ultimate 

thrust  shoulder  #7  against 
roller  bearing  #8  which 

failure. 

in  turn  is  retained  by 

2.  If  flange  of  Part  #2 

Part  #2  flange. 

would  hold,  bearing  #8 
would  deteriorate  and 
initiate  a  warning  system 
while  maintaining  power. 

2.  Looseness  or 

Same  as  failure  #1 

Same  as  failure  #1 

failure  of 

Part  #4 

3.  Bearing  #9 

Same  as  failure  #1 

Same  as  failure  tfl 

failure 

4.  Shaft  failure 

1.  Ring  gear  is  axially 

1.  Flange  of  Part  #2  would 

in  section  #5 

displaced  but  restrained 

shear  causing  an  ultimate 

by  thrust  shoulder  #7 
against  roller  bearing 

failure. 

#8,  which  in  turn  is 

2.  If  flange  of  Part  #2 

restrained  by  Part  #2 

would  hold,  roller  bearing 

flange. 

#8  and  sun  gear  would  de¬ 
teriorate  but  power  would 

2.  Moment  reaction  is 
carried  by  sun  gear  and 

be  maintained. 

roller  bearing  #8. 

3.  If  flange  of  Part  #2 
would  hold  bearing  and 

3.  Gear  tooth  loads 

gear,  deterioration  would 

would  be  increased. 

4.  Roller  bearing  loads 
would  be  increased. 

5.  Rapid  deterioration 
of  gear  and  bearing 
would  occur. 

6.  Bearing  #8  retainer 
flange  Part  #2  would 
have  to  take  thrust 
load. 

initiate  a  warning  system 
while  maintaining  power. 
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TABLE  VII  -  Continued 


Failure  Mode 

Effect 

Results 

5.  Shaft  failure 
in  primary 
torque  path 
(ring  gear  to 
sun  gear)  of 
section  #6 

1.  Torque  path  would  be 
through  the  secondary 
path. 

2.  Pressurized  cavity 
would  emit  a  medium  de¬ 
tectable  by  a  warning 
system. 

1.  Power  would  be 
maintained. 

2.  Warning  system  would 
be  initiated. 

6.  Shaft  failure 
in  secondary 
torque  path 
(ring  gear  to 
sun  gear)  of 
section  #6 

1.  Pressurized  cavity 
would  emit  a  medium  de¬ 
tectable  by  a  warning 
system. 

1.  Power  would  be  main¬ 
tained  indefinitely. 

2.  Warning  system  would  be 
initiated. 

7.  Bearing  #8 
failure 

1.  Sun  gear  would  react 
the  gear  mesh  loads. 

1.  Power  would  be  main¬ 
tained. 

2.  Increased  sun  gear 
loads  would  cause  tooth 
deterioration. 

2.  Gear  tooth  deteriora¬ 
tion  would  be  detected  by 
a  warning  system. 
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Figure  46.  Transmission  Component  Restrictor, 


This  section  addresses  the  major  categories  of  components 
in  helicopter  transmissions  from  the  viewpoint  of  conse¬ 
quences  and  hazard  function  shape;  the  two  factors  which 
affect  the  need  for  TBO's.  From  this  discussion  a  pattern 
will  emerge  in  those  design  areas  requiring  special  atten¬ 
tion  when  attempting  to  achieve  an  on-cond.ition  status. 
Table  VIII  presents  an  overview*  of  the  discussion. 

a.  Bearings 

Bearings  have  historically  been  cited  as  the  prime 
reason  for  a  TBO .  Traditionally,  the  lowest  B^g  life 
of  a  bearing  in  the  transmission  has  defined  the  TBO 
interval.  Implicit  in  this  approach  is  the  suggestion 
that  an  increase  in  the  failure  rate  will  occur  at  the 
Big  point.  This,  or  course,  is  not  necessarily  so. 

Tne  Big  life  simply  means  that  theoretically  10%  of 
the  units  will  have  failed  by  that  point  and  says 
nothing  about  how  the  failures  were  distributed  up  to 
that  point  or  will  be  distributed  after  that  point. 

The  8  factor  in  the  Weibull  equation  expresses  the 
change  in  failure  rate  as  a  function  of  time.  Certain 
tests  conducted  on  bearings  (Reference  5)  have  indi¬ 
cated  that  the  8  past  the  Big  point  is  approximately 
1.  This  means  that  the  failure  rate  is  basically  con¬ 
stant  and  the  failures  randomly  distributed.  These 
same  tests  indicated  an  increasing  failure  rate  (8 
approximately  1.5)  up  to  the  Big  point.  Even  higher 
8's  were  evident  in  certain  bearings  in  the  CH-47C 
transmissions  reviewed.  The  bearing  data  shown  in 
Figure  47  had  a  8  of  2.6.  Why  this  slope  is 
higher  than  the  r.5  value  cited  in  Reference  5  and 
other  bearing  literature  is  not  clear.  With  higher 
loadings  on  a  bearing,  there  appears  to  be  a  shift 
of  8  as  well  as  the  expected  shift  in  Big  life.  This 
area  is  further  discussed  in  Appendix  IV  of  this 
report. 

The  Reference  5  tests  were  conducted  on  the  bench  under 
ideal  operating  conditions  and  the  resultant  B’s  prior 
to  the  Big  point  may  not  be  applicable  to  bearings  in¬ 
stalled  in  helicopter  transmissions.  Some  bearings 
have  exhibited  a  generally  constant  failure  rate 
throughout  their  early  periods  and  some  have  even 
shown  a  marked  infant  mortality.  This  is  most  likely 
due  to  the  fact  that  the  failure  mechanism  in  many 
bearings  is  not  basic  subsurface  fatigue  originated 
spalling.  Quality  defects,  installation  damage,  or 
improper  alignment  all  contribute  to  an  infant  mortal¬ 
ity  shape  on  installed  bearings. 
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Figure  47.  Weibull  Plot  of  114DS240  Bearing  Failures. 


Regardless  of  this  infant  mortality  region,  bearings 
should  not  determine  TBO  when  the  g  is  even  as  high  as 
2.0  or  3.0.  The  highest  g  that  can  be  tolerated  de¬ 
pends  on  the  reliability  of  the  bearing.  The  higher 
the  B^q  life  or  6  (both  measures  of  the  reliability) , 
the  higher  the  tolerable  g.  For  example,  Figure  48 
displays  the  average  failure  rate  throughout  the  life 
of  an  aircraft  (3600  hours)  as  a  function  of  6  and  Biq 
life.  This  figure  indicates  that  g's  as  high  as  3.0 
can  be  cost-effective  when  operated  without  a  TBO  if 
the  B]_q  is  as  high  as  3000  hours. 

Most  bearing  failures  are  highly  detectable.  A  nor¬ 
mally  slow  failure  progression  coupled  with  adequate 
detection  systems  usually  produces  a  warning  before 
structural  integrity  is  lost.  One  example  is  in 
Figure  47  which  plots  the  basic  failure  data  from 
the  bearing,  and  adds  the  data  points  of  those  failures 
which  progressed  to  the  point  of  causing  an  unscheduled 
removal  of  the  transmission.  This  later  data  can  also 
be  described  in  Weibull  equation  form  with  a  g  and  0 
similar  to  the  basic  failure  data,  but  with  a  C  value 
of  250  hours.  This  failure  progression  of  250  hours 
is  typical  of  roller  bearings  where  the  failure  orig¬ 
inates  within  the  bearing  itself  and  is  not  due  to  the 
complete  loss  of  lubrication,  as  in  the  case  of  jet 
blockage . 

With  this  failure  progression,  bearings  are  not  a 
safety  concern  but  rather  a  cost  issue.  As  such,  they 
can  exhibit  an  increasing  failure  rate  with  g's  as 
high  as  2.0  or  3.0  v,  .en  the  B^q  lives  are  1  or  2  times 
the  life  of  the  transmission  as  long  as  these  failures 
are  detectable. 

b.  Seals 


Nonrotating  seals  such  as  "0"  rings  and  gaskets  are 
rarely,  if  ever,  a  safety  issue.  Slight  external  leak¬ 
age  is  usually  the  indication  of  problems.  More  im¬ 
portantly,  the  hazard  function  for  these  seals  will 
usually  have  a  decreasing  failure  rate  with  time. 

Their  susceptibility  to  installation  damage  or  quality/ 
manufacturing  problems  contribute  to  this  infant 
mortality  shape. 

rotating  seals,  on  the  other  hand,  may  have  a  g  greater 
tnan  1  depending  on  the  mechanism  of  failure.  If  con¬ 
tinual  running  contact  is  present,  it  is  likely  that  a 
real  wear-out  characteristic  might  be  manifested.  This 
possibility  can  be  minimized  through  design  approaches 
which  permit  repair  of  the  seals  without  assembly 
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Figure  48.  Failure  Rate  Versus  B^q  Life. 
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removal.  Thus,  neither  nonrotating  nor  rotating 
seals  need  ever  define  a  TBO  interval. 

c.  Retention  and  Mounting  Hardware 

Unfortunately,  design  areas  such  as  locknuts,  bearing 
outer  race  liners,  bearing  inner  race  spacers,  and 
similar  types  of  components  have  frequently  been  high 
failure  items.  In  many  instances,  there  have  been 
distinct  wearout  type  failure  mechanisms  associated 
with  these  components;  however,  these  components  are 
very  subject  to  installation  variation  which  result  in 
infant  mortality  (g<l)  hazard  functions.  These  two 
factors  have  combined  to  result  in  generally  constant 
failure  rates  in  current  transmission  experience.  In 
the  future,  however,  exposures  to  higher  operating 
times  may  lead  to  clearly  increasing  failure  rates. 

This  potential  can  probably  be  tolerated  if  the  modes 
are  detectable.  This  has  been  a  difficult  task  on 
slowly  accumulating  wear  or  on  relatively  nonfunctional 
components.  The  debris  generated  by  wear  of  these  parts 
is  generally  of  minute  quantities  and  requires  more 
sophisticated  indicating  devices  than  are  currently  in 
production.  In  instances  where  detection  of  the  prime 
mode  is  impossible,  the  failure  progression  or  sequence 
could  be  designed  so  that  a  signal  is  generated  through 
the  degradation  of  an  associated  component.  Redundancy 
of  function  of  a  nondetectable  component  must  be  accom¬ 
panied  by  an  increase  in  detection  capability  to  realize 
any  practical  benefit.  This  detection  capability  is  an 
area  which  requires  the  designer's  attention.  Alter¬ 
nately  (and  preferably) ,  efforts  should  be  made  to 
minimize  this  type  of  hardware  through  simplified  de¬ 
sign  concepts,  if  the  design  is  to  eventually  operate 
without  a  TBO. 

d.  Nonrotating  Structure 

Transmission  cases,  including  internal  webs  and  sup¬ 
ports  plus  external  mounting  lugs  and  hardware, do  not 
usually  exhibit  failure  modes  whose  frequency  increases 
with  time.  Material  or  process  errors  have  contributed 
to  a  high  percentage  of  case  or  lug  cracks,  and  mainte¬ 
nance  damage  causes  many  hardware  problems  with  studs, 
bushings,  etc.  These  causal  factors  tend  to  produce  a 
relatively  constant  or  even  decreasing  failure  rate 
with  time.  Because  of  the  relatively  high  frequency  of 
load  application  on  transmission  structure,  manufac¬ 
turing  or  quality  defects  (as  well  as  basic  errors  in 
load  predictions)  will  be  manifested  in  a  relatively 
short  operating  time. 
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Consider,  for  instance,  a  load  application  from  the 
rotor  head  which  occurs  at  250  rpm.  One  million  cycles 
of  load  (where  the  S/N  curve  flattens)  will  be  reached 
in  60  hours  of  transmission  operation.  Beyond  this 
point  no  significant  increase  in  failure  probability 
is  likely.  Thus,  extensions  of  TBO  from,  say,  1200 
hours  to  3000  hours  are  not  likely  to  introduce  a 
fatigue  problem. 

One  area  of  concern  is  the  future  use  of  composites 
for  cases:  some  research  has  indicated  composites 
have  a  tendency  to  wide  ranges  of  6  in  their  failure 
distributions.  Designs  incorporating  composites 
should  receive  special  attention  to  assure  that  the 
0  is  well  beyond  the  expected  life  of  the  transmission. 

Another  potential  problem  to  extended  life  of  trans¬ 
missions  is  the  failure  mechanism  of  stress  corrosion. 
Because  of  the  calendar  time  effects  on  this  mode  it 
has  been  difficult  to  relate  the  probability  of  failure 
to' operating  time.  This  mechanism  and  means  of  pre¬ 
vention  require  further  study. 

From  a  detectability  standpoint,  case  and  housing 
cracks  have  traditionally  been  evidenced  through  ex¬ 
ternal  oil  leakage  and  are  therefore  a  cost,  rather 
than  safety  concern.  Cracks  of  supports  or  webs  are 
not  as  easily  detectable.  Fatigue  cracks  do  not 
usually  produce  sufficient  debris  to  trigger  the  tra¬ 
ditional  oil  system  devices  (chip  detectors,  filters, 
etc.).  Although  high-frequency-load  fatigue  failures 
are  unlikely  (as  discussed  previously) ,  low-cycle 
fatigue  problems  (due  to  landings  and  takeoffs,  or 
certain  maneuver  conditions)  are  possible.  Design 
attention  should  therefore  be  directed  at  improving 
failure  detectability  in  these  areas  of  design. 

e.  Rotating  Structure 

This  area  of  design  is  perhaps  most  critical  to  suc¬ 
cessfully  removing  TBO's.  Shafting,  gearing,  splines, 
and  clutches  have  each  presented  real  restraints  to 
TBO  removal  due  to  the  relative  undetectability  of 
failures,  the  seriousness  of  the  failures,  and  a  his¬ 
torically  increasing  failure  rate  with  component  time. 

(1)  Shafting 

The  major  area  of  shafting  concern  is  not  the 
classical  fatigue  crack.  Most  of  the  prior  dis¬ 
cussion  of  high  frequency  loading  is  applicable 
here,  even  more  dramatically.  At  a  shaft  speed 
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of  7000  rpm,  the  fiat  portion  of  a  steel  S/N  curve 
is  reached  in  only  two  operating  hours  of  the 
transmission.  The  real  areas  of  concern  are 
fatigue  problems  originating  from  fretting.  This 
mechanism  is  time  dependent  and  virtually  unde¬ 
tectable  by  traditional  oil  system  devices. 

Splines,  gear  mounting  surfaces,  and  shaft/bearing 
interfaces  are  all  sources  of  fretting.  This  is 
an  area  where  design  approaches  can  have  real  pay¬ 
offs:  EB  welding,  for  instance,  can  eliminate 
many  heretofore  bolted  joints  and  their  attendant 
problems.  Where  fretting  surfaces  remain  in  de¬ 
signs,  their  integrity  must  be  assured  by  a  com¬ 
bination  of  appropriately  conservative  design 
allowables,  and,  in  addition,  endurance  tests 
must  be  run  to  verify  that  the  fretting  endurance 
limit  is  sufficiently  above  operating  load  to 
assure  safe  operation  with  an  extremely  high 
statistical  probability.  Improved  detectability 
of  shafting  failures  could  relieve  the  urgency  of 
these  requirements.  New  and  innovative  approaches 
will  have  to  be  studied. 


Gearinc 


Gear  tooth  spalling  from  either  surface  or  sub¬ 
surface  origins  is  generally  detectable.  The 
potential  for  high  8,  however,  requires  that 
conservative  design  allowables  be  employed  in 
order  to  minimize  its  appearance. 


In  a  similar  manner,  gear  tooth  root  bending 
fatigue  problems  would  not  be  detectable  until  a 
complete  tooth  was  lost,  at  which  time  a  cata¬ 
strophic  seizure  could  occur.  Experience  has 
shown,  however,  that  conservative  design  allow¬ 
ables  can  effectively  preclude  the  occurrence  of 
this  mode  of  failure. 


Splines 


Wear  and/or  fretting  mechanisms  on  spline  teeth 
have  been  a  constant  reliability  problem  in  past 
designs.  Both  are  time  dependent  phenomena  which 
are  relatively  undetectable.  As  in  the  case  of 
shafting  and  gearing,  conservative  design  ap¬ 
proaches  can  significantly  reduce  the  probability 
of  failure.  Close  attention  to  inspection  capa¬ 
bility  can  assist  in  removing  spline  wear  from  a 
safety  domain.  Additional  research  must  be 
directed  at  the  reliability  and  detectability  of 


128 


this  design  area.  It  can  be  a  real  restraint  to 
TBO  extensions,  in  certain  instances,  because  of 
its  inherently  high  6  characteristic,  unless  the 
0  is  high  enough  to  shift  the  increasing  hazard 
rate  beyond  the  component's  service  life. 

(4)  Clutches 


Based  on  past  experience,  clutch  designs,  espe¬ 
cially  those  used  in  high  speed  applications, 
must  be  considered  a  high  risk  item.  Most  failure 
modes  are  time  dependent,  being  of  a  wear  (sprags, 
discs,  etc.)  or  fatigue  (cages,  drag  clips,  etc.) 
nature.  Inspection  or  diagnostics  capabilities 
have  been  limited  due  to  an  inadequate  under¬ 
standing  of  the  effects  of  wear  upon  clutch  oper¬ 
ations.  Precise  wear  limits,  drag  readings,  en¬ 
gagement  times,  etc.,  have  not  proven  to  be 
accurate  indications  of  the  clutch's  ability  to 
perform.  Particle  or  debris  generation  has  been 
of  such  small  size  and  at  such  a  slow  rate  of 
accumulation  that  oil  system  debris  sensors  have 
not  been  able  to  consistently  detect  clutch  wear. 

Although  there  is  some  research  under  way  to 
investigate  alternate  clutch  concepts,  it  appears 
that  near-term  designs  should  attempt  to  place 
the  clutch  in  a  location  which  allows  removal/ 
replacement  without  total  assembly  removal. 
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APPENDIX  III 

FAILURE  WARNING  AND  INSPECTION  CRITERIA 
FOR  ON-CONDITION  TRANSMISSIONS 


INTRODUCTION 


Previous  sections  have  dealt  with  the  capability  of  transmis¬ 
sions  to  be  operated  on-condition  based  primarily  upon  their 
inherent  values  of  $,  0  and  flight  safety  reliability.  However, 
by  incorporating  a  failure  warning  and  inspection  system,  the 
consequences  of  failure  modes  and  rates  can  be  significantly 
altered.  For  instance,  a  5-minute  airborne  failure  warning  for 
a  mode  that  would  cause  loss  of  a  flight-critical  function  re¬ 
moves  that  mode  from  the  safety  of  flight  category  since  the 
pilot  has  time  to  take  corrective  action.  Similarly,  a  failure 
warning  and  inspection  system  can  impact  mission  reliability, 
maintenance  man-hours  per  flight  hour,  and  life  cycle  costs. 
Thus,  the  critical  question  is  that  for  those  transmissions 
which  cannot  meet  the  criteria  for  on-condition  maintenance 
through  their  inherent  design  can  a  failure  warning  and  in¬ 
spection  system  be  defined  which  would  enable  such  transmis¬ 
sions  to  be  operated  on-condition  safely  and  economically? 


SUMMARY 

This  section  develops  the  criteria  for  defining  failure  warning 
and  inspection  requirements  for  transmissions  to  be  operated  on- 
condition  and  develops  methods  of  optimizing  the  implementation 
of  such  requirements.  First,  the  role  of  a  failure  warning  and 
inspection  system  is  discussed  and  he  methods  of  identifying 
maintenance  significant  failure  moues  for  new  and  existing 
transmissions  are  outlined.  Next,  mathematical  and  logical 
tests  are  developed  for  classification  of  failure  modes  rela¬ 
tive  to  the  type  of  diagnostic  requirements  they  generate  (i.e., 
airborne  versus  ground  failure  warning  versus  ground  inspection), 
and  for  identification  of  failure  modes  that  do  not  require  any 
type  of  failure  warning  or  inspection.  Sample  trade  studies 
are  then  performed  to  illustrate  a  method  of  ranking  the  rela¬ 
tive  suitability  of  alternative  sensing  techniques  to  detect 
representative  failure  modes  on  gears  and  bearings.  Signal 
conditioning  require -.lent  s  are  discussed  relative  to  the  need 
for  conversion  of  raw  transducer  signals  into  truth  values  for 
fault  statements  which  can  be  processed  by  fault-isolation 
logic.  Finally,  there  is  a  brief  discussion  of  signal  flow 
analysis  which  is  the  methodology  for  developing  fault-isolation 
logic  to  evaluate  all  permutations  and  combinations  of  fault 
statement  truth  values.  This  then  allows  the  required  failure 
warning  and  inspection  messages  to  be  displayed  to  the  flight 
crew  and  maintenance  personnel. 
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Figure  50  of  this  section  identifies  the  decision 
criteria  for  evaluating  those  modes  requiring  failure 
warning  and  inspection  in  order  that  a  gearbox 
operate  on  condition.  Stepping  through  this  deci¬ 
sion  chart  with  the  data  provided  in  Tables  XL  and  XLIII 
of  Appendix  VIII  and  in  Figures  72  through  78  of 
Appendix  IX  for  the  CH-47C,  it  is  determined  that  no 
additional  failure  warning  and  inspection  gear  are 
required  to  render  the  CH-47C  transmissions  suitable 
for  on-condition  operation.  An  analysis1  performed 
by  Boeing  Vertol  in  1971  reiterates  this  position. 

Thus,  although  the  decision  criteria  identified  in 
Figure  50  may  appear  prohibitive,  it  is  postulated 
here  that  if  these  criteria  are  applied,  it  may  be 
found  that  many  present  generation  helicopter  gear¬ 
boxes  are  capable  of  on-condition  operatior  with  a 
minimal  addition  of  failure  warning  and  inspection 
equipment. 


THE  ROLE  OF  FAILURE  WARNING  AND  INSPECTION  SYSTEMS 
FOR  ON-CONDITION  TRANSMISSIONS 

The  failure  warning  and  inspection  system  can  be 
configured  to  play  a  role  in  as  many  as  four  basic 
areas:  flight  safety  reliability,  mission  reli¬ 

ability,  life  cycle  overhaul  costs,  and  aircraft 
maintenance  burden  and  availability.  The  degree 
to  which  a  failure  warning  and  inspection  system 
influences  each  of  these  areas  is  a  function  of 
the  system's  design  concept. 

The  section  on  failure  warning  and  inspection- 
related  criteria  will  more  fully  discuss  the 
various  system  design  concepts,  while  this  section 
will  identify  the  means  by  which  a  maximum  capa¬ 
bility  system  plays  a  role  in  each  of  the  above  four 
areas . 
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Flight  Safety  Reliability 


Failure  warning  and  inspection  offers  potential 
improvement  to  flight  safety  reliability  through 
basic  approaches: 

•  Warning  of  impending  failures 

•  Reduction  of  exposure  to  transmission  infant 
mortality 

Failure  warning  provides  advance  notice  of  impending 
flight  safety  failures.  This  then  allows  the  pilot 
increased  time  in  which  to  take  corrective  action. 
Secondly,  it  provides  maintenance  personnel  with  an 
improved  capability  for  differentiating  between 
failure  modes  which  ar^  serious  enough  to  justify 
transmission  removal  and  those  which  are  minor  and 
do  not  warrant  transmission  removal.  As  /.  result, 
unwarranted  transmission  removals  are  reduced  with  a 
consequent  reduction  in  exposure  to  the  infant  mortal¬ 
ity  associated  with  newly  manufactured  or  newly  over- 
nauled  transmissions. 

Mission  Reliability 

Improvements  in  mission  reliability  can  be  expected 
because  of  the  ability  of  a  failure  warning  and  inspec¬ 
tion  system  to  provide  maintenance  personnel  with  a 
more  accurate  and  detailed  inspection  capability  for 
internal  components  along  witn  time  to  failure 
prognosis,  reducing  both  ground  and  air  aborts.  In 
addition,  the  ability  to  provide  notification  and 
quantification  of  specific  failure  modes  gives  the 
pilot  additional  ability  upon  which  to  base  a  ground 
or  air  abort  decision. 

Maintenance  Burden  and  Availability 

A  failure  warning  and  inspection  system  will  decrease 
the  maintenance  man-hours  per  flight  hour  required 
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to  perform  routine  inspections.  This  will  in  turn  also  re¬ 
duce  the  required  skill  levels  of  the  on-aircraft  maintenance 
personnel. 


The  time-to-failure  prognosis  capability  provided  by  failure 
warning  will  supply  maintenance  planning  data  to  facilitate 
spares  provisioning  along  with  more  effective  use  of  personnel 
and  facilities,  increasing  aircraft  availability. 

Life  Cycle  Overhaul  Costs 

Increased  MTBR,  through  the  reduced  quantity  of  unnecessary 
unscheduled  removals  discussed  previously,  has  an  obvious 
impact  in  the  reduction  of  life  cycle  overhaul  costs.  In 
addition,  there  is  a  small  potential  cost  benefit  from  the 
reductions  in  secondary  damage  that  will  occur  where  adequate 
impenaing  failure  warning  is  provided.  Further  cost  reduc¬ 
tions  can, result  from  some  previously  life-limited  parts  that 
no  longer  need  be  discarded  at  overhaul,  while  improved  life- 
extension  data  can  be  gathered  for  those  life-limited  parts 
that  remain. 

Summary 


A  successful  failure  warning  and  inspection  system  can: 

•  Improve  flight  safety  reliability 

Reduce  exposure  to  infant  mortality  via  fewer  premature 
removals 

Provide  pilot  notification  of  impending  SOF  failures 

•  Improve  mission  reliability 

Provide  more  accurate  and  detailed  inspection  capability 
of  internal  components  not  normally  accessible  to  quality 
control  personnel 

Provide  real-time  notification  and  quantification  of  in¬ 
flight  failures 

•  Reduce  aircraft  MMH/FH  and  increase  availability 

Reduce  scheduled  maintenance  requirements 

Provide  maintenance  plannirg  data  for  maintenance 
facility 
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•  Reduce  life  cycle  overhaul  costs 

Extend  MTBR  (equals  MTBO)  through  reduced  premature 
removal  rate 

Reduce  secondary  damage 

Reduce  effect  of  life  limited  parts  and  provide  life 
extension  data  for  those  that  remain 


FAILURE  WARNING  AND  INSPECTION  RELATED  CRITERIA 


The  task  sequence  to  be  followed  in  determining  the  failure 
warning  and  inspection  requirements  for  any  transmission  is 
to  identify  failure  modes,  classify  failure  mode,  trade  off 
sensor  packages,  meet  signal  conditioning  requirements  and 
analyze  signal  flow.  This  section  is  divided  into  segments 
corresponding  to  these  tasks,  and  each  segment  includes  the 
criteria  from  which  the  requirements  are  generated.  It  must  be 
emphasized  here  that  the  failure  warning  and  inspection  require¬ 
ments  for  a  specific  transmission  configuration  are  unique  to 
that  configuration  and  not  directly  transferable  to  a  different 
configuration.  This  does  not  mean,  however,  that  similar  tech¬ 
niques,  sensors  and  signal  processing  equipment  cannot  be  used 
for  a  number  of  different  configurations  if  proper  judgement 
is  exercised  in  combining  the  above  elements  according  to  the 
criteria  defined  in  this  report. 

The  sample  sensor  package  tradeoffs  contained  in  this  section 
are  not  intended  to  be  applicable  to  any  specific  transmission 
configuration,  but  are  included  only  to  illustrate  methodology 
and  some  of  the  alternative  sensing  techniques  available. 

Identification  of  Failure  Modes 

For  the  purpose  of  evaluating  the  potential  of  various  failure 
warning  and  inspection  systems  for  improving  transmission  on- 
condition  potential,  it  is  necessary  that  a  failure  mode  effect 
and  criticality  analysis  (FMECA)  be  performed  for  the  consid¬ 
ered  transmission 

For  existing  transmissions  on  which  historical  field  experience 
or  test  data  is  available,  identification  of  failure  modes 
should  be  fairly  straightforward.  Modes  should  be  identified 
in  terms  of  their  hazard  function  parameters,  6  and  e.  These 
values  can  be  calculated  from  historical  data  using  the 
methods  identified  in  Appendix  V  of  this  report. 

For  new  design  transmissions,  estimates  must  be  made  of  the 
frequency  at  which  each  mode  will  occur.  For  assistance  in 
this  area,  the  generic  failure  mode  distribution  identified 
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in  Appendix  VIII  of  this  report  can  be  employed.  The  values 
determined  for  the  frequency  of  mode  occurrence  can  then  be 
transformed  into  the  8  parameter  of  the  mode  hazard  functions 
using  the  MTBF  versus  Bio/9  program  in  Appendix  VII.  Generic 
limits  of  the  8  parameter  have  been  developed  and  presented 
in  Appendix  VIII  of  this  report.  Thus,  utilizing  the  data 
presented  in  Appendix  VIII  of  this  report  along  with  the  reli¬ 
ability  prediction  for  the  total  assembly,  the  parametric 
representation  of  the  hazard  function  for  each  failure  mode 
can  be  developed. 

Failure  Mode  Classification 

Having  identified  all  the  significant  maintenance  failure 
modes  for  a  specified  gearbox  configuration,  the  next  task  is 
to  classify  each  mode  and  part  combination  according  to  its 
impact  on  safety  of  flight  (SOF)  mission  reliability,  mainte¬ 
nance  burden  and  life  cycle  costs  so  that  the  failure  warning 
and  inspection  requirements  can  be  defined.  For  the  purposes 
of  this  analysis,  a  safety  of  flight  failure  mode  is  defined 
as  any  mode  which  results  in  immediate  loss  of  a  flight  criti¬ 
cal  function.  Thus,  gear  breakage,  bearing  seizure  or  dis¬ 
integration,  shaft  breakage,  and  missing  or  broken  critical 
retention  and  mounting  hardware  are  SOF  modes;  however,  de¬ 
structive  pitting  and  spalling,  scoring,  and  abrasive  wear, 
although  definitely  mission  affecting,  are  non-SOF  modes. 

Figure  49  is  a  Venn  diagram  representing  the  relationship  of 
mission  affecting  and  safety  of  flight  failure  modes  to  fail¬ 
ure  warning  requirements.  The  innermost  circle  contains  all 
the  SOF  modes  that  can  be  tolerated  while  still  meeting  the 
gearbox  flight  safety  reliability  requirement  where  for  an  on- 
condition  analysis  the  requirement  is  equal  to  the  total 
safety  affecting  failure  rate  that  would  be  encountered  if  the 
gearbox  were  operated  with  a  TBO.  The  second  circle  repre¬ 
sents  the  boundary  of  all  SOF  modes  inherent  in  the  transmis¬ 
sion  design,  including  those  which  can  be  eliminated  from  the 
SOF  category  by  failure  warning.  Thus,  the  area  between  the 
first  and  second  circles  contains  all  the  failure  modes  that 
must  be  removed  from  the  SOF  category  by  providing  real  time 
failure  warning  to  the  flight  crew.  This  failure  warning  must 
provide  advance  notification  sufficient  for  corrective  action 
(i.e. ,  a  different  mode  of  operation  or  precautionary  landing) 
to  be  taken.  The  area  within  the  third  circle  contains  all 
the  allowable  mission  affecting  modes  compatible  with  the 
transmission's  reliability  requirement  (note  that  all  the  in¬ 
herent  SOF  modes,  including  those  removed  from  the  SOF  cate¬ 
gory  by  failure  warning,  are  included  as  mission-affecting 
modes).  Again,  for  an  on-condition  analysis,  the  requirement 
is  equal  to  the  total  mission  affecting  malfunction  rate  that 
would  be  encountered  if  the  gearbox  were  operated  on  condition. 
The  fourth  circle  contains  all  the  mission  affecting  failure 
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inodes  inherent  in  the  gearbox  design,  including  those  which 
can  be  removed  from  the  mission  affecting  category  by  failure 
warning  or  inspection.  The  area  between  the  third  and  fourth 
circles,  therefore,  represents  all  those  modes  which  require 
sufficient  failure  warning  so  that  maintenance  personnel  are 
notified  or  impending  failure  prior  to  initiation  of  flight. 

It  should  be  noted  at  this  point  that  a  subtle,  but  signifi¬ 
cant  difference  exists  between  failure  warning  requirements 
for  mission-affecting  and  SOF  modes.  The  SOF  mode  failure 
warning  must  be  real  time  and  therefore  requires  on-board 
signal  conditioning  and  analysis;  but  the  non-SOF  mission- 
affecting  mode  failure  warning  is  intended  primarily  for  pre¬ 
flight  indication  to  maintenance  personnel.  Therefore  the 
signal  processing  and  analysis  can  be  performed  by  a  piece  of 
GSE  through  evaluation  of  recorded  raw  data  transferred  from 
the  airborne  portion  of  the  failure  warning  and  inspection 
system.  The  exception  to  this  rule  is  the  rapidly  progressing 
non-SOF  mission-affecting  mode  that  must  be  diagnosed  to  pro¬ 
vide  failure  warning  for  a  safety  of  flight  mode  such  as  lube 
starvation  leading  to  a  critical  bearing  seizure. 


Figure  50  is  a  decision  flow  chart  which  defines  the  criteria 
by  which  failure  warning  and  inspection  requirements  are  gen¬ 
erated  for  each  mode  and  part  combination.  The  first  step  is 
to  perform  a  failure  mode  effect  and  criticality  analysis 
(FMECA) .  Secondly,  proceed  with  the  analysis  of  the  safety  of 
flight  modes  to  determine  which  ones  have  MTBF's  less  than  the 
flight  safety  reliability  limit  factor,  K]_,  times  the  MTBUR  of 
the  gearbox  when  operated  with  a  TBO .  It  should  be  noted  here, 
that  for  simplicity  in  the  following  discussion,  the  modal  0 
is  used  in  a  manner  similar  to  the  way  one  would  usually  use 
MTBF ,  that  is,  the  6  values  are  meant  to  be  inversely  repre¬ 
sentative  of  the  rate  at  which  the  mode  occurs.  Here  we  are 
making  use  of  two  facts  which  allow  us  to  use  0  rather  than 
MTBF.  First,  for  0  values  much  greater  than  5000  hours,  fail¬ 
ure  modes  with  0  values  greater  than  1  increase  very  little  in 
the  0  to  5000  hour  operating  regime.  Secondly,  since  we  do  a 
0  test  on  those  modes  with  low  0's,  we  are  merely  simplifying 
the  process  by  using  0  synonymously  with  MTBF,  since  the  0 
issue  does  come  into  play  for  the  critical  low  0  modes. 

Identification  of  these  modes  and  determination  of  K]_  is 
accomplished  as  follows: 


1.  List  all  inherent  SOF  failure  modes  in  order  of  increasing 
0.  Thus,  for  a  transmission  with  n  safety  of  flight  modes 


fl  £  A  <  A  <  <  a  <  a  <  <  A 

°1  «2  “  w3  •*•  P  ~  P+1  ”  *•*  "  n 


(1) 
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2.  Determine  ep  such  that 


I_  +  _i_  +  JL_  + 

0P  9Pfl  0P+2 


(2) 


where  Rs  =  transmission  flight  safety  reliability 
which  results  from  operating  with  a 
certain  TBO. 


v  p  _ 

3.  Set  where  0  =  transmission  MTBUR  when 

9  operated  with  a  certain 

TBO. 


4.  Check  to  see  if  modes  1  through  P-1  can  be  removed 
from  the  safety  of  flight  category  by  providing 
failure  warning.  If  this  cannot  be  accomplished 
with  a  reasonable  probability  of  success,  must 
be  revised  according  to  Steps  5  through  7. 


5.  If  modes  X,  Y  and  Z  cannot  be  diagnosed  by  use  of 
the  criteria  of  Step  4,  determine  a  revised  value 
of  9p  such  that 


+ 


1-Rg  (3) 


If 


R 


s 


the  transmission  cannot  go  on  condition  without  at 
least  one  of  the  following  modifications: 


•  Suitable  redesign  to  reduce  the  magnitude 
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•  Suitable  redesign  to  allow  failure  warning  to 
be  accomplished  for  modes  X,  Y  and  Z. 

•  Testing  to  evaluate  failure  mechanisms,  fail¬ 
ure  progression  rates  and/or  modal  hazard 
functions  to  determine  whether  the  modes  can 
or  cannot  be  tolerated  from  a  safety  aspect. 

6.  When  equation  (3)  is  true,  calculate  a  revised 
value  of  K-j/ 


7.  Return  to  step  4  and  test  for  the  revised  value 
of  P.  If  the  requirements  are  not  met,  repeat 
steps  5  through  7  and  if  they  are  met,  a  final 
value  for  Ki  has  been  determined  in  equation  (4) 
(note  that  modes  X,  Y,  and  Z  have  been  exempted 
from  their  failure  warning  requirement  in  spite 
of  their  MTBF's  being  less  than  times  the 
transmission  MTBUR  when  operated  with  a  TBO) . 

Thus,  SOF  modes  1  through  P-1  from  equation  (1)  will 
all  have  MTBF's  less  than  the  flight  safety  reli¬ 
ability  limit  factor  times  the  transmission  MTBR  and 
therefore  require  real-time  failure  warning.  How¬ 
ever,  for  modes  P  through  n  where  0  >  KW,  additional 
criteria  must  be  satisfied  to  establish  whether  or 
not  failure  warning  will  be  required.  If  the  mode's 
hazard  function  is  constant  or  decreasing,  the  MTBF 
then  will  not  decrease  to  less  than  Kj/T  and  failure 
warning  will  not  be  required.  If  the  mode's  hazard 
function  is,  however,  increasing  (6>1)  ,  we  must 
establish  whether  or  not  the  minimum  MTBF  during 
the  life  of  the  part  will  drop  below  the  K}F  limit. 
If  the  MTBF  will  drop  below  this  limit,  then 
failure  warning  is  required  to  assure  continued 
compliance  with  the  required  flight  safety 
reliability.  If  the  MTBF  will  not  fall  below 


the  K^O  limit,  failure  warning  is  not  required  (although  it  may 
be  desirable  due  to  the  increasing  failure  rate) . 

Next  we  proceed  with  a  similar  analysis  of  the  non-SOF,  mission- 
affecting  failure  modes  to  identify  those  modes  with  0  param¬ 
eters  less  than  the  mission  reliability  limit  factor,  K2,  times 
the  transmission  MTBUR  when  operated  with  a  TBO.  Determination 
of  the  mission  reliability  limit  factor  is  accomplished  as 
follows: 

1.  Let  4>  represent  the  summation  of  all  the  SOF  failure  rates 
whose  modes  were  removed  from  the  safety  of  flight  cate¬ 
gory  by  providing  real-time  failure  warning.  Thus,  from 
equation  (1)  of  the  SOF  modes  analysis, 


(5) 


2.  List  all  the  inherent  non-SOF  mission  affecting  failure 
modes  in  order  of  increasing  0.  Thus  for  a  transmission 
with  m  such  modes, 


@1  -  02  -  63  -  •••  -  eq  “  9q+i  ~  £  em  (6) 

3.  Determine  6g  such  that 

+  e^+i  +  •••  +  ^  +  <!»  +  (1-RS)  =  1-Rm  (7) 

where  =  transmission's  mission  reliability  which  results 
from  operating  with  a  certain  TBO. 

4.  Set  K2  =  0q/0* 

5.  Check  to  see  if  modes  1  through  q-.l  can  be  removed  from 
the  mission-affecting  category  by  providing  preflight 
failure  warning.  If  this  cannot  be  accomplished  with  a 
reasonable  probability  of  success,  K2  must  be  revised 
according  to  steps  6  through  8 . 

6.  If  modes  U,  V,  and  W  cannot  be  diagnosed  through  use  of 
the  requirements  of  step  5,  determine  a  revised  value  of 
0q  such  that 

hr  +  TT—  +  •••  +  L.  +  4  +  (1-RS)  +  +  h-  +  h-  =  1-RM  (9) 

9q  6q+l  9m  °U  9 V  9W 

If  4,  4-  (1-RS)  +  ^  ^  >  1-Rm  (IQ) 
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The  transmission  cannot  go  on  condition  without  one  of  the 

following  modifications: 

•  Suitable  redesign  to  reduce  the  magnitude  of 

<p  +  (1-RS)  +  ^  ^  A  to  less  than  1-Rm. 

•  Suitable  redesign  to  allow  preflight  failure  warning 
to  be  accomplished  for  modes  U,  V,  and  W. 

•  Testing  to  evaluate  failure  mechanisms,  failure  progres¬ 
sion  rates  and  modal  hazard  functions  to  determine 
whether  the  modes  can  or  cannot  be  tolerated  from  a 
mission  reliability  aspect. 

7.  When  equation  (9)  is  true,  calculate  a  revised  value  of  K2: 


k;  =  6'/  0  (id 

2  q 

8.  Return  to  step  5  and  test  for  the  revised  value  of  q.  If 
the  requirements  are  not  met,  repeat  steps  6  through  8  and 
if  the  requirements  are  met,  a  final  value  for  K2  has  been 
determined  in  equation  (11)  (note  that  modes  U,  V,  and  W 
have  been  exempted  from  their  failure  warning  requirement 
in  spite  of  their  MTBF's  being  less  than  K2  times  the 

transmission  MTBUR  when  operated  with  a  TBO) . 

As  shown  then,  non-SOF  mission-affecting  modes  1  through  q-1 
from  equation  (6)  will  all  have  MTBF's  less  than  the  mission 
reliability  limit  factor  times  the  transmission  MTBUR  and 
therefore  will  require  preflight  failure  warning.  However, 
for  modes  q  through  m  where  0>0K2,  additional  criteria  must 
be  satisfied  to  establish  whether  or  not  failure  warning  will 
be  required.  If  the  mode's  hazard  function  is  constant_or  de¬ 
creasing,  then  its  MTBF  cannot  decrease  to  less  than  K20  and 
failure  warning  is  not  required.  But  if  the  modes'  hazard 
function  is  increasing  (6>1),  we  must  establish  whether  or  not 
the  minimum  MTBF  during  the  life  of  the  part  will  drop  below 
the  K2O  limit.  If  the  MTBF  will  drop  below  this  limit,  then 
failure  warning  is  required  to  assure  continued  compliance 
with  the  mission  reliability  requirement;  but  if  it  will  not 
fall  below  the  I<20  limit,  failure  warning  is  not  required. 

We  now  proceed  to  analyze  the  non-mission-affecting  failure 
modes.  An  intrinsic  concern  of  these  modes  is  that  they 
should  not  falsely  activate  the  failure  warning  sensors  for 
the  SOF  and  mission-affecting  modes.  If  a  non-mission-af fect- 
ing  mode  can  activate  the  sense  s,  then  an  inspection  capabil¬ 
ity  is  required  to  provide  direct  indication  of  its  nature 
(i.e.,  non-mission-affecting).  If  this  inspection  capability 
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cannot  be  provided,  the  SOF  and  mission-affecting  modes' 
analyses  must  be  reiterated  to  account  for  the  removal  of 
confused  failure  warning  capabilities.  Having  accomplished 
this,  we  must  list  all  the  non-SOF  mission-affecting  and  non¬ 
mission-affecting  modes  that  do  not  require  failure  warning  or 
inspection  and  determine  if  each  will  progress  to  a  secondary 
mode  within  the.  life  expectancy  of  its  associated  part. 

If  a  secondary  mode  appears  to  be  imminent,  then  the  entire 
preceding  analysis  must  be  carried  out  for  the  secondary 
mode. 

The  next  phase  of  failure  mode  classification  is  to  identify 
tnose  modes  which  heavily  impact  the  on-aircraft  maintenance 
burden  (maintenance  man-hours  per  flight  hour)  and  derive  the 
criteria  which  will  identify  their  inspection  requirements. 

The  basic  assumption  here  is  that  the  MTTR  for  many  failure 
modes  can  be  significantly  reduced  through  shorter  trouble¬ 
shooting  times  available  with  an  inspection  system. 

Figure  51  is  a  Venn  diagram  illustrating  the  relationship  of 
on-aircraft  maintenance  burden  due  to  modes  with  previously 
defined  failure  warning  or  inspection  requirements,  mode 
whose  total  maintenance  burden  falls  within  the  allowable 
limit  and  all  the  inherent  maintenance-significant  failure 
modes.  Figure  51  shows  that  the  modes  in  the  area  between 
the  middle  and  outer  circles  will  require  inspection  capa¬ 
bility  sufficient  to  reduce  the  inherent  maintenance  burden 
to  the  required  maintenance  man-hours  per  flight  hour.  These 
modes  are  identified  as  those  for  which  the  MMH/FH  savings 
due  to  inspection  is  greater  than  the  maintenance  burden  limit 
factor,  K3,  times  the  total  transmission  maintenance  burden. 
The  maintenance  burden  limit  factor  is  calculated  as  follows: 


1.  Let  t  -  reduction  in  on-airc.raft  MTTR  due  to  inspection 


capability.  Let  AMB  =  Required 


MMH 

FH 


-  Inherent 


MMH 

FH 


Arrange  all  maintenance  significant  modes  without  previ¬ 
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MMH/FH  DUE  TO  MODES  WITH 
PREVIOUSLY  DEFINED  FAILURE 
WARNING  OR  INSPECTION 
REQUIREMENTS 


Figure  51.  On-Aircraft  Maintenance  Burden. 
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where  Mg  =  total  transmission  maintenance  burden  encoun¬ 
tered  wher  operating  with  a  TBO.  Thus,  modes  1  through 
r-1  will  each  contribute . a  MMH/FH  savings  greater  than  the 
maintenance  burden  limit  factor  times  the  total  trans¬ 
mission  on-aircraft  maintenance  burden  requirement.  This 
means  that  the  timesaving  inspection  techniques  available 
for  these  modes  are  required  to  achieve  the  transmissions 


MMH 

FH 


goal . 


The  remaining  undiagnosed  modes  r  through  l,  do  not  re¬ 
quire  failure  warning  or  inspection  to  comply  with  flight 
safety  reliability,  mission  reliability  or  maintenance 
man-hour  per  flight  hour  requirements;  however,  an  inspec¬ 
tion  capability  may  be  desirable  from  the  life  cycle  costs 
point  of  view.  The  assumption  made  here  is  that  by  having 
an  inspection  capability  to  diagnose  a  given  failure  mode, 
the  incorrect  removal  rate  for  the  mode  will  decrease. 

This  lower  incorrect  removal  rate  translates  into  cost 
savings  by  decreasing  logistics  costs,  pipeline  spares  re¬ 
quirements  and  off-aircraft  repair  parts  and  labor  costs. 
Thus,  if  the  decrease  in  incorrect  removals  per  flight  hour 
times  the  cost  per  incorrect  removal  is  greater  than  the 
cost  per  flight  hour  of  the  added  inspection  capability, 
then  the  additional  inspection  gear  is  cost  effective  and 
therefore  desirable.  Thus, when 

Rj  =  decrease  in  incorrect  removals  per  flight  hour  due 
to  added  inspection  capability 

CIR  =  cost  per  incorrect  removal 

Cj  =  cost  per  flight  hour  of  added  inspection  capability 
then  if 

RI  *  CIR  >  °I 

the  additional  inspection  gear  is  desirable. 

For  an  expression  of  Rj  which  includes  a  95-percent  prob¬ 
ability  that  the  actual  rate  will  be  equaJ  to  or  greater 
than  the  calculated  value,  let 
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rs  =  reduction  of  incorrect  removal  rate  due 
to  additional  inspection  capability 


T  =  life  cycle  fleet  flight  hours 

t  =  life  cycle  component  hours 

0{yj  =  MTBUR  due  to  failure  mode 

Then  _  _ 

rs  (t/eM  ~  1.63/  t/FM) 

RI  95  PCT  =  T 


For  the  cost  per  flight  hour  of  added  inspection  gear, 
let 

N  =  no.  of  units  procured  for  fleet  life  cycle 

Mbi  =  direct  maintenance  costs  (per  flight  hour) 

As  =  unit  acquisition  cost  differential  due  to  the  added 
inspection  gear 

Then 

N  •  As  +  N  •  MBI  •  T 
Ct  =  - f - 


Thus,  for  a  95-percent  confidence  level,  that  inspection 
gear  will  be  desirable  for  cost  savings  on  modes  r  through 


rs  (t/0M  -  1.63/t/7M  ) 
T 


As  +  N 
T 


M 


BI 


T 


In  summary  then,  each  failure  mode  and  part  combination  iden¬ 
tified  for  the  transmission  must  be  analyzed  according  to  the 
procedure  outlined  in  Figure  50.  In  this  way,  the  failure 
warning  and  inspection  requirements  are  derived  directly  from 
the  transmission's  performance,  maintainability  and  operating 
cost  requirements,  rather  than  through  a  haphazard  approach. 
This  assures  that  the  failure  warning  and  inspection  hardware 
will  not  be  overdesigned  for  diagnostics  overkill  and  v/ill 
provide  easily  visible  information  for  the  sensitivity  of 
transmission  performance  to  individual  failure  warning  and 
inspection  requirements. 
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Finally,  when  all  the  aircraft  diagnostic  requirements  are 
identified  and  the  failure  warning  and  inspection  system  is 
designed,  the  system  itself  must  undergo  the  same  analysis  to 
identify  its  own  required  built-in  test  equipment  (BITE) . 

Sensor  Package  Tradeoffs 

Having  identified  all  significant  failure  modes,  grouped  them 
according  to  their  mechanism  and  classified  them  as  to  their 
hazard  functions  and  effect  on  safety  of  flight,  etc.,  next 
evaluate  the  various  sensing  techniques  available  to  detect 
each  failure  mode  in  each  component  class. 

The  NSIA  Tradeoff  Technique  (Ref.  ALM-43-3566-LC (A) )  is  used 
to  objectively  develop  quantitative  scores  indicative  of  the 
relative  values  of  alternative  sensing  techniques  in  perform¬ 
ing  failure  warning  and  inspection  of  a  given  failure  mode  on 
a  specific  component.  Three  scores  are  calculated  for  each 
sensing  technique.  The  total  score  considers  all  parameters 
and  considerations  listed  on  the  tradeoff  data  sheet,  while 
the  detection  score  considers  only  the  asterisked  (*)  consid¬ 
erations  which  relate  purely  to  the  ability  of  the  alternative 
sensing  techniques  to  find  and/or  predict  failures.  The 
summary  score  is  simply  the  sum  of  the  total  score  plus  the 
detection  score. 


NSIA  TRADEOFF  SCORING  RATIONALE 


Relative  Weighting 

The  relative  weighting  values  vary  from  1  to  4  and  are  in¬ 
tended  to  represent  the  relative  importance  of  each  of  the 
parameter  considerations  shown  in  Table  IX  and  included  in  the 
NSIA  tradeoff  (4  is  the  most  important) .  These  values  are 
held  constant  for  all  of  the  failure  warning  and  inspection 
techniques  being  evaluated  for  a  specific  failure  mode.  How¬ 
ever,  weighting  factors  may  be  varied  between  failure  modes 
to  account  for  individual  variations  in  failure  mode  charac¬ 
teristics  such  as  secondary  damage,  safety,  and  type  of  hazard 
function.  The  following  text  is  a  detailed  description  of  the 
rationale  used  as  guidelines  to  assign  relative  weighting 
values  to  each  of  the  parameter  considerations. 

Failure  Warning  -  This  consideration  is  weighted  as  a  function 
of  the  individual  failure  mode  hazard  function,  impact  on 
safety  of  flight  (SOF)  and  secondary  damage/failure  mode  con¬ 
siderations.  As  a  general  guideline,  this  is  given  a  relative 
weighting  of  2  for  non-SOF  failure  modes  with  decreasing  or 
constant  hazard  functions  and  4  for  modes  with  increasing 
hazard  functions  or  near  term  effects  on  SOF. 
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TABLE  IX.  FAILURE  WARNING  AND  INSPECTION  SENSOR 

PACKAGE  PARAMETERS  AND  CONSIDERATIONS 
(CRITERIA) 

Parameter 

Considerations 

Capability 

Failure  warning  and 
inspection* 

Nature  of  indication 

Direct  or  indirect*  for 
mode  and  part 

Sensor  suitability 

Reliability 

Cost 

Accuracy  versus  requirement* 
Multiple  function  capability 
component  design  impact 

Associated  hardware 

Complexity,  reliability, 
versatility,  and  cost 

Other 

As  warranted 

*Items  include  in  NSIA  detection  score 


Inspection  -  This  consideration  is  weightea  a  basis  similar 
to  that  for  failure  warning,  but  with  the  additional  assump¬ 
tion  that,  generally,  the  total  number  of  occurrences  of  a 
particular  failure  mode  during  the  life  cycle  of  an  on- 
condition  transmission  is  directly  proportional  to  the  hazard 
function  of  the  mode.  This  means  that  a  mode  with  a  decreas¬ 
ing  hazard  function  will  result  in  fewer  total  failures  during 
the  life  cycle  than  a  mode  with  a  significant  constant  hazard 
function  which  in  turn  results  in  fewer  total  failures  than  a 
mode  with  an  increasing  hazard  function.  The  guideline  values 
for  inspection  capability  are  2,  3,  and  4  for  non-SOF  failure 
modes  with  decreasing,  constant,  and  increasing  hazard  func¬ 
tions  respectively,  and  4  for  all  safety  of  flight  failure 
modes . 

Direct  or  Indirect  Indication  -  This  consideration  refers  to 
the  ability  of  a  fc'.ilure  warning  and  inspection  technique 
to  directly  detect  symptoms  of  a  specific  failure  mode  rather 
than  indirectly  via  a  secondary  mode, and  identify  a  particular 
discrepant  part  or  assembly  within  the  transmission.  For  non- 
SOF  failure  modes  with  decreasing  or  constant  hazard  func¬ 
tions,  this  consideration  is  given  a  relative  weighting  of  2 
and  for  increasing  hazard  function  modes  a  weighting  of  3. 

A  weighting  of  4  is  assigned  to  all  SOF  failure  modes. 

\ 

Sensor  Reliability  -  This  consideration  has  been  assigned  the 
maximum  weighting  of  4  and  is  constant  for  all  failure  modes. 
The  criticality  of  sensor  reliability  is  primarily  due  to 
three  factors:  (1)  the  serious  consequences  of  undetected 
failures  in  terms  of  both  SOF  degradation  and  secondary 
damage;  (2)  the  high  costs  of  processing  incorrect  removals 
resulting  from  false  failure  indications?  and  (3)  the  cost  of 
performing  sensor  maintenance  due  to  accessibility  restric¬ 
tions  and/or  calibration  requirements. 

Sensor  Cost  -  Sensor  costs  must  be  minimized  to  prevent  on- 
condition  O&M  cost  savings  from  being  wiped  out  by  increased 
component  acquisition  costs.  This  consideration  is  given  a 
relative  weighting  of  3  and  is  not  considered  to  vary  as  a 
function  of  failure  mode. 

Sensor  Accuracy  Versus  Requirement  -  It  is  important  that  the 
sensor  adequately  distinguish  between  a  failure  mode  which 
has  progressed  to  an  unacceptable  limit  and  one  which  has 
begun  but  not  yet  progressed  to  a  stage  requiring  corrective 
action.  The  relative  weighting  of  this  consideration  can  vary 
considerably  between  failure  modes.  The  value  assigned  is 
based  primarily  on  engineering  judgment.  The  following  is 
used  as  a  guideline:  non-SOF  failure  modes  with  decreasing 
or  constant  hazard  functions  are  weighted  at  2  and  those  with 
increasing  hazard  functions  are  weighted  at  3,  while  all  SOF 
failure  modes  are  4. 


149 


Sensor  Multiple  Function  Capability  -  Considerable  improve- 
ments  in  sensor  package  reliability  and  overall  component  cost 
can  be  achieved  if  a  particular  sensor  can  adequately  perform 
two  or  more  functions.  This  consideration  therefore  is 
assigned  a  relative  weighting  of  3  and  is  considered  non¬ 
variable  as  a  function  of  failure  mode. 

Component  Design  Impact  -  The  impact  of  the  sensor  on  compo¬ 
nent  design  can  be  of  considerable  importance  to  the  component 
cost.  This  is  particularly  true  if  sensor  output  is  trans¬ 
mitted  via  hard  wiring  and  slip  rings  internal  to  the  transmis¬ 
sion  or  if  structural  modifications  to  a  production  design  are 
required.  Therefore  this  consideration  is  assigned  a  non¬ 
variable  relative  weighting  of  4. 

Associated  Hardware  Complexity  -  This  item  is  of  moderate 
importance  because  it  may  impose  cost,  weight,  and  power  pen¬ 
alties  and  require  skilled  maintenance  personnel  for  checkout 
and  repair.  The  relative  weighting  assigned  is  2  and  is  con¬ 
sidered  a  constant. 

Associated  Hardware  Reliability  -  Although  associated  hardware 
reliability  is  somewhat  critical  in  relation  to  undetected 
failures,  it  will  be  external  to  the  monitored  component  and 
therefore  more  easily  accessible  for  checkout  and  repair. 
Relative  weighting  is  2  and  considered  nonvariable. 

Associated  Hardware  Versatility  and  Cost  -  These  considera¬ 
tions  are  similar  to  sensor  multiple  function  capability  and 
cost,  therefore  they  are  assigned  the  same  relative  weighting 
of  3  which  is  considered  nonvariable. 

It  should  be  emphasized  that  the  above  discussion  is  the 
rationale  used  to  develop  the  guideline  values  for  relative 
weighting  and  that  minor  variations  to  these  values  for  indi¬ 
vidual  failure  modes  are  considered  permissible  when  the  vari¬ 
ations  can  be  backed  by  sound  engineering  judgment.  Table  X 
is  a  summary  of  the  relative  weighting  guideline  values 
discussed. 


BASIC  RATINGS 

The  basic  rating  values  range  from  -100  to  +100  for  each  of 
the  parameter  considerations  used  to  evaluate  the  worth  of  a 
failure  warning  and  inspection  technique  relative  to  a  specific 
failure  mode.  Any  positive  rating  indicates  a  desirable  fea¬ 
ture  and  therefore,  any  negative  value  indicates  undesirability 
directly  proportional  to  the  absolute  value  of  the  assigned 
basic  rating.  The  basic  ratings  correspond  to  qualitative 
evaluations  based  upon  field  experience,  test  data  and  engi¬ 
neering  judgment.  Basic  rating  guidelines  which  relate 
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TABLE  X.  RELATIVE  WEIGHTING  GUIDELINE  VALUES 
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guideline  numerical  values  to  the  qualitative  evaluations  of 
each  of  the  parameter  considerations  are  tabulated  in  Tables 
XI  through  XIV. 

Table  XV  is  a  comparison  of  sensor  suitability  and  associated 
hardware  parameter  considerations  which  remain  constant  for 
each  failure  warning  and  inspection  technique,  regardless  of 
the  failure  mode  to  which  the  technique  is  applied. 


BEARING/GEARING  NSIA  TRADE  STUDY 


The  following  discussion  provides  a  detailed  example  of  the 
manner  in  which  NSIA  trade  studies  would  be  performed  for  the 
component  class  gears  and  bearings. 

It  should  be  noted  that  this  trade  study  has  been  performed 
as  an  example  of  methodology  contingent  upon  some  general 
assumptions  about  gearbox  configuration.  Thus,  the  results 
of  the  trades  should  not  be  construed  as  representative  of  the 
ideal/universal  diagnostics  package. 

Sensor  Evaluations  for  Gearing  Failure  Modes 


The  significant  failure  modes  for  the  component  class  gearing 
are  listed  in  Table  XVI,  and  six  sensing  techniques  have  been 
selected  for  comparative  evaluation.  In  the  following  para¬ 
graphs  each  of  these  techniques  is  described  in  terms  of  con¬ 
ceptual  design  and  functional  capability. 

Chip  Detector 

Conceptual  Design  -  A  coarse  mesh  screen  made  of  parallel, 
alternately  polarized  conducting  wires  laid  on  a  grid  of  neu¬ 
tral,  nonconducting  filaments  which  run  normal  to  the  conduct¬ 
ing  wires  is  located  at  the  entrance  of  the  sump  scavenge  oil 
line.  A  second  set  of  wires  which  run  parallel  to  the  con¬ 
ducting  loops  form  a  locking  weave  which  binds  the  conducting 
loop  wires  to  the  neutral  nonconducting  filaments.  Resistors 
are  wired  in  series  with  each  sensing  loop  to  control  the 
flow  of  current  as  a  function  of  debris  quantity. 

Functional  Capability  Assumptions  - 

1.  Exposure  to  100  percent  of  oil  flow  and  90  percent  of 
sedimentary  debris. 

2.  Not  sensitive  to  particles  of  normal  wear  size  or  an 
accumulation  of  normal  wear  particles. 

3.  Not  sensitive  to  electrically  nonconduction  particles. 
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TABLE  XI.  NATURE  OF  INDICATION  PARAMETER 


Nature  of  Indication 

Basic 

Direct 

Indirect 

None 

Rating 

Mode 

& 

Part 

+100 

Mode 

Part 

+  75 

Part 

Mode 

+  50 

Mode 

& 

Part 

+  25 

Mode 

Part 

0 

Mode 

Part 

-  25 

Part 

Mode 

-  50 

Part 

Mode 

-  75 

Part 

& 

Mode 

-100 

TABLE  XII.  DETECTION  CAPABILITY  PARAMETER 


Failure 

Non-Safety  of 

Flight  Failure  Modes 

Safety 

Warning  or 

Decreasing 

Constant 

Increasing 

of 

Inspection 

Hazard 

Hazard 

Hazard 

Flight 

Capability 

Function 

Function 

Function 

Failure  Mode 

Yes 

+60 

+80 

+90 

+  100 

Maybe 

+  10 

+20 

+  40 

+  50 

No 


0 


0 


-90 


-100 


TABLE  XIII.  SENSOR  SUITABILITY  PARAMETER 


Consideration 

Qualitative 

Evaluation 

Basic 

Rating 

Excellent 

+100 

High 

+  75 

Good 

+  50 

Reliability 

Fair 

0 

Low 

-  50 

Poor 

-  75 

Unacceptable 

-100 

Low 

+  100 

Cost 

Moderate 

0 

High 

-100 

Excellent 

+  100 

High 

+  75 

Accuracy  versus 

Good 

+  50 

requirement 

Acceptable 

0 

Fair 

-  50 

Low 

-  75 

Unacceptable 

-100 

All  modes 

+  100 

High 

+  75 

Multiple  function 

Good 

+  50 

capability 

Fair 

0 

Low 

-  50 

Poor 

-  75 

None 

-100 

None 

+  100 

Low 

+  75 

Component  design 

Moderate 

0 

impact 

High 

-  75 

Very  high 

-100 

TABLE  XIV.  ASSOCIATED  HARDWARE  PARAMETER 


Consideration 

Qualitative 

Evaluation 

Basic 

Rating 

Low 

+100 

Complexity 

Moderate 

0 

High 

-100 

Excellent 

+  100 

High 

+  75 

Good 

+  50 

Reliability 

Moderate 

0 

Low 

-  50 

Poor 

-  75 

Unacceptable 

-100 

All  signals 

+  100 

High 

+  50 

Versatility 

Moderate 

0 

Low 

-  50 

None 

-100 

Low 

+  100 

Cost 

Moderate 

0 

High 

-100 
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TABLE  XVI.  GEAR  FAILURE  TERMS/TYPES/DEGREES 
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(usually  associated 

with  working  Nicked  Mutilated 

splines ) 


4.  Provides  continuous  indication  of  debris  quantity  (rate 
optional)  for  metalic  particles  of  larger  than  normal  wear 
size . 

5.  High  reliability. 

Shock  Detector 


Conceptual  Design  -  Shock  pulses  with  a  high  energy  rise  and 
very  short  duration  originate  from  tooth  contacts  in  the 
rotating  gear  mesh  and  bearing  rolling  element  contacts  with 
the  bearing  races.  A  ringing  accelerometer  with  a  resonance 
of  38  kHz  is  mounted  on  a  nonrotating  structure  (i.e.,  a 
bearing  housing)  and  resonates  due  to  the  shock  pulses  propa¬ 
gating  at  the  speed  of  sound  through  the  gear  or  bearing 
materials.  An  amplifier  tuned  r.o  the  accelerometer  resonance 
picks  up  the  results  of  the  shock  pulse  while  ignoring  the 
lower  frequency  background  vibration  due  to  elastic  resonances 
within  the  gear  and  bearing  elements  and  surrounding  structure. 

Functional  Capability  Assumptions  - 

1.  A  shock  pulse  is  a  sharp  rise,  short  duration  pulse  of 
energy  related  directly  to  the  severity  of  dynamic  contact 
between  two  surfaces. 

2.  Shock  pulse  amplitude  is  attenuated  markedly  (empirical 
data  indicates  14  db  or  80  percent)  at  mechanical 
interfaces . 

?.  Normal  shock  pulse  amplitude  from  dynamic  tooth  contact  in 
a  gear  mesh  is  sufficiently  large  to  be  detectable  through 
a  nearby- support  bearing  on  the  gear  shaft. 

4.  Shock  pulse  propagation  is  independent  of  gear,  bearing, 
or  mounting  structure  elastic  resonance  and  thus  is  not 
affected  by  changes  in  this  property  with  load  or  wear. 

5.  The  ringing  accelerometer  will  have  good  reliability  for 
a  permanent  but  highly  inaccessible  installation. 

In-Line  Oil  Monitor 

Conceptual  Design  -  The  in-line  oil  monitor  employs  a  trans¬ 
ducer  mounted  in  the  oil  line  and  a  signal  conditioner  which 
can  be  remotely  located.  The  oil  is  monitored  by  measuring 
light  scattering  caused  by  suspended  particulates,  and  light 
attenuation  resulting  from  chemical/therma.L  degradation.  An 
output  corresponding  to  flow  rati  is  also  provided.  The  de¬ 
sign  incorporates  internal  stable  references  to  make  the 
monitor  automatically  and  continuously  self-calibrating.  Tne 
use  of  sealed  fiber  optics  in  the  transducer  eliminates  con¬ 
ventional  windows  and  lenses  in  the  optical  path. 
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Functional  Capability  Assumptions  - 


1.  High  sensitivity  to  provide  early  indication  of  incipient 
malfunction. 

2.  Ability  to  detect  metallic,  nonmetallic,  particulate  or 
dissolved  impurities  for  debris  quantity  and  rate. 

3.  Capable  of  detecting  chemical/thermal  degradation  of  the 
oil. 

4.  Continuous  flow  monitoring  provided. 

5.  Fair  to  good  reliability. 

Advanced  Transmission  Monitoring  Eevice  (XMD) 

Conceptual  Design  -  Figure  52  is  a  cutaway  view  of  the  XMD 
which  would  be  mounted  in  an  oil  line  downstream  of  the  chip 
detector,  and  Figure  53  outlines  the  signal  conditioning  cir¬ 
cuitry.  The  sensing  screen  is  similar  to  that  of  the  chip 
detector  incorporating  resistors  wired  in  series  with  each 
sensing  loop  to  control  the  flow  of  current  as  a  function  of 
metallic  debris  quantity.  In  order  to  provide  a  capability 
of  detecting  nonmetallic  debris,  the  XMD  incorporates  a 
differential  pressure  switch  to  activate  a  warning  after  a 
certain  percentage  of  the  screen  becomes  blocked. 

Functional  Capability  Assumptions  - 

1.  High  sensitivity  to  metallic  debris  quantity  and  rate. 

2.  Gross  sensitivity  to  nonmetallic  debris. 

3.  No  sensitivity  to  dissolved  impurities  or  chemical/thermal 
degradation  of  the  oil. 

4.  High  reliability. 

Radioactive  Tracer 


Conceptual  Design  -  A  radiation  sensor  is  installed  in  an  oil 
line  or  sump  with  close  proximity  to  the  filter  screen  or  de¬ 
bris  trapping  mechanism.  Critical  wear  parts  are  impregnated 
with  specific  radioactive  tracer  elements.  As  wear  progresses 
to  critical  limits,  the  radioactive  tracer  element  particles 
are  counted  by  the  radiation  sensor  and  the  discrepant  part  is 
identified  by  the  energy  level  of  the  radiation  corresponding 
to  the  tracer  element  with  which  it  was  treated.  The  extent 
of  wear  and  rate  of  progression  can  then  be  made  available  by 
signal  conditioning  similar  to  that  of  the  transmission  moni¬ 
toring  device  (XMD) .  It  should  be  noted  that  the  central  cone 
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MOUNTING  COLLAR 


Figure  52.  Transmission  Debris -Monitoring  Device 


TOTAL  ACCUMULATION 
CIRCUITRY 


CLOSED 

OPEN 


TIMER  SEQUENCING 


Figure  53.  Particle  Detector  Circuitry. 
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of  the  transmission  monitoring  device  (XMD)  would  be  the  ideal 
location  of  the  radiation  sensor,  particularly  if  the  chip 
detector  screen  were  located  at  the  entrance  of  the  transmis¬ 
sion  monitoring  device.  Also  in  an  alternate  configuration, 
the  radioactive  sensor  could  be  a  piece  of  GSE  used  to  period¬ 
ically  check  debris  traps  and  oil  for  tracer  radioactivity. 

One  variation  of  this  technique  is  know  as  kryptonation.  A 
kryptonate  is  a  sol’d  which  has  been  impregnated  by  radio¬ 
active  krypton  -85  gas.  Forming  a  kryptonate  (called  kryptona¬ 
tion)  is  accomplished  by  diffusion  of  the  gas  into  the  material 
under  temperature.  A  kryptonated  metal  releases  a  portion  of 
its  krypton  upon  being  heated  to  the  initial  temperature  at 
which  the  gas  was  introduced,  and  further  heating  at  or  below 
this  temperature  results  in  no  further  loss  of  radioactivity. 
Additional  krypton  -85  is  emitted  only  when  the  maximum  tem¬ 
perature  attained  during  the  previous  heating  is  exceeded. 
Consequently,  the  maximum  surface  temperature  of  a  gear  mesh 
can  be  monitored  in  an  actual  operating  transmission  and 
krypton-impregnated  wear  particles  can  be  detected  by  a  radi¬ 
ation  sensor  in  the  transmission  monitoring  device. 

Functional  Capability  Assumptions  - 

1.  Accurate  treatment  of  critical  wear  parts  with  radioactive 
tracer  elemei  ts  is  practical. 

2.  Tracer  elements  with  sufficiently  distinctive  radiation 
energy  levels  are  available  without  generating  hazards 
to  human  health. 

3.  Critical  wear  limits  can  be  accurately  defined. 

4.  Radiation  sensor  will  have  good  reliability. 

5.  Tracer  elements  will  remain  in  oil. 

6.  Satisfactory  shelf  life  for  tracer  treated  components 
(due  to  isotope  half-life) . 

Magnetic  Plug 

The  magnetic  plug  type  of  sensor  was  not  included  in  the 
sensor  tradeoffs  due  to  the  following  inherent  deficiencies: 

1.  Failure  warning  is  accomplished  through  a  random  collec¬ 
tion  of  about  2  percent  of  the  generated  debris. 

2.  A  safe  gap  setting  results  in  numerous  false  pilot  warn¬ 
ings  from  an  accumulation  of  normal  wear  particles. 
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3.  The  magnetic  plug  has  no  capability  to  provide  indication 
of  debris  quantity  or  rate  of  generation. 

4.  The  magnetic  plug  provides  no  indication  of  the  following 
failure  modes  which  would  be  found  by  the  screen  type  chip 
detector  and/or  transmission  monitoring  device. 

•  The  generation  of  aluminum  or  magnesium  filings  (a 
bearing  retaining  nut  which  backs  off  against  a 
housing  can  produce  this  condition) . 

•  Bronze  particles  from  a  failed  bearing  cage. 

•  Oxides  produced  in  the  gearbox  sump. 


NS I A  TRADEOFF  -  GEARING 

Table  XVII  presents  a  summary  of  the  NSIA  tradeoff  performed 
for  the  component  class  gearing.  A  sample  tradeoff  for  gear¬ 
ing  tooth  fracture  and  breakage  is  shown  in  the  following 
pages . 

Tables  XVIII  through  XXII  demonstrate  the  format  of  the  work 
sheets  employed  as  an  intermediate  step  toward  the  development 
of  Table  XXIII. 


NSIA  TRADEOFF  -  BEARINGS 


Table  XXIV  presents  a  summary  of  the  NSIA  tradeoff  performed 
for  the  component  class  bearings.  A  sample  tradeoff  for 
bearing  abnormal  wear  is  shown  in  the  following  pages. 

Tables  XXVI  through  XXXI  demonstrate  the  format  of  the  work 
sheets  employed  as  an  intermediate  step  toward  the  develop¬ 
ment  of  Table  XXV. 

Sensor  Evaluations  for  Bearing  Failure  Modes 


The  significant  bearing  failure  modes  are  listed  in  Table 
YxxiII  and  six  types  of  sensors  have  been  selected  for  com¬ 
parative  evaluation.  Five  of  these  six  sensor  types  are 
described  in  the  gearing  sensor  evaluations,  the  sixth  type 
is  described  below. 

Thermocouples 

Conceptual  Design  -  Redundant  thermocouples  are  mounted  on  a 
bearing  housing.  These  thermocouple  sets  from  a  number  of 
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TABLE  XVII.  NS I A  SENSOR  TRADEOFF,  SUMMARY  SCORE  CHART;  COMPONENT 
CLASS,  GEARING 
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NSIA  Total  Score:  +26.2  NSIA  Detection  Score:  60. 
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bearings  can  time-share  a  single  resistance  bridge  type  signal 
conditioner  with  built-in  temperature  compensation.  The  indi¬ 
vidual  bearing  thermocouples  are  calibrated  by  subjecting  the 
temperature-compensating  resistor  to  known  temperature  changes. 

Functional  Capability  Assumptions  - 

1.  Meaningful  temperature  limits  can  be  established  for 
correlation  with  probability  of  component  damage  or 
failure. 

2.  Adequate  thermocouple  bonding  materials  are  available  to 
withstand  the  oil/heat/vibration  environment  on  the  bear¬ 
ing  housings. 

3.  Sensors  will  have  high  in-situ  reliability. 


SENSOR  EVALUATIONS  FOR  LUBE  SYSTEM  FAILURE  MODE? 

Table  XXXIV  lists  lube  system  failure  modes  and  potential  fail¬ 
ure  warning  and  inspection  techniques.  Present  studies 
indicate  that  the  NSIA  tradeoff  technique  can  be  useful  in 
developing  optimum  sensing  technique  recommendations  for 
specific  applications  within  a  well  defined  lube  system  con¬ 
figuration,  but  that  a  more  generalized  application  for  a 
typical  lube  system  would  be  misleading.  For  this  reason,  the 
following  paragraphs  will  discuss  the  various  sensing  tech¬ 
niques  in  a  general  manner,  but  with  a  minimum  o*7  recommenda¬ 
tions  for  specific  applications  which  would  principally  be  a 
function  of  individual  system  configuration. 


Visual  Inspection 

Most  types  of  noncatastrophic  leakage  due  to  a  gradual  deteri¬ 
oration  of  seals,  lines,  couplings,  or  small  fatigue  cracks  in 
oil  cooler  lines  can  be  adequately  detected  by  daily  visual 
inspections.  However,  this  technique  would  n~>t  be  adequate 
for  internal  or  catastrophic  leaks  such  as  those  resulting 
from  combat  damage  or  ruptured  lines. 

Oil  Level  Indication 


Two  basic  types  of  level  sensors,  acoustic  and  capacitance, 
seem  most  suitable  for  rapid  oil  level  indication  of  cata¬ 
strophic  leaks.  Each  of  these  types  can  be  configured  for 
either  point  indication  or  continuous  readout.  However,  the 
accuracy  of  capacitance  type  sensors  may  be  adversely  affected 
by  conditions  that  change  the  dielectric  constant  cf  the  oil 
such  as  temperature,  entrained  gases,  or  suspended  solids. 
Conversely,  acoustic  devices  can  be  obtained  for  operation  not 
affected  by  changes  in  dielectric  constant,  viscosity, 
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TABLE  XXXIV.  LUBE  SYSTEM  FAILURE  MODES  AND  FAILURE  WARNING  AND 
INSPECTION  TECHNIQUES 
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heat  transfer  Resistance  thermometers  or  thermistors 

of  contamination  Debris  monitoring  (XMD,  ILOM) 


temperature,  resistance,  pressure,  clinging  droplets,  coating 
buildup  or  foam.  Figures  54  and  55  illustrate  typical  point 
indication  and  continuous  reading  acoustic  level  sensors. 

Some  of  the  principal  elements  that  must  be  considered  when 
selecting  level  sensors  for  a  specific  gearbox  and  lube  system 
configuration  are: 

•  Lube  system  redundancy  and  isolation  (cross  connections) 

•  Achievable  safe  dry  running  time 

•  Normal  and  acceptable  limits  of  oil  level  and  oil  level 
fluctuations  in  all  sumps  and  reservoirs 

Shock  Detection 


A  shock  detector  (operating  principle  previously  described) 
mounted  on  an  oil  pump  housing  should  be  sensitive  to  cavita¬ 
tion,  debris  and  bearing  damage  within  the  pump. 

Differential  Pressure  Indication 


Differential  pressure  sensors  would  find  their  principal  area 
of  application  in  detecting  restrictions  to  flow  prior  to 
total  line  blockage.  To  a  lesser  degree,  they  may  be  used 
for  leak  detection,  but  would  probably  be  far  less  sensitive 
than  flow  indication  fcr  all  but  extreme  cases  of  this  mode. 

In  addition,  differential  pressure  sensing  can  be  used  as  a 
backup  or  checking  technique  for  flow  monitoring. 

Flew  Monitoring 

Flow  sensors  are  the  primary  means  for  diagnosing  pump,  line, 
or  cooler  leakage  and  blocked  lubrication  jets.  There  are 
several  types  of  flow  sensors  with  a  wide  variation  in  cost, 
size  and  accuracy.  Some  of  the  more  promising  techniques  are 
discussed  with  observations  of  strengths  and  weaknesses;  how¬ 
ever,  actual  recommendations  cannot  be  made  without  a  specific 
gearbox  and  lube  system  configuration. 

Drac  (or  Lift)  Meters  -  These  may  be  defined  as  meters  that 
are  acted  upon  by  the  fluid  stream  so  that  a  force  is  mani¬ 
fested,  allowing  the  flow  rate  to  be  inferred.  In  practice, 
the  configuration  is  such  that  the  force  is  directly  propor¬ 
tional  to  the  kinetic  energy  of  the  fluid  stream.  Due  to  the 
unavailability  of  suitable  force  transducers,  this  technique 
has  poor  potential  for  continuous  readout,  but  finds  its  pri¬ 
mary  application  in  f low/no-f low  indication. 
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Figure  54.  Point-Sensitive  Level  Indicator. 
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Figure  55 


Continuous  Readout  Level  Indicator 


Turbine  Meter?  -  A  rotor,  with  its  centerline  coincident  with 
the  center  of  flow,  turns  at  a  speed  directly  proportional  to 
the  stream  velocity.  The  rotor  rpm  provides  an  electrical  out¬ 
put  for  continuous  readout  with  relatively  good  accuracy  ;  how¬ 
ever ,  the  cost  is  somewhat  high  and  the  sensor  will  not  fit  in 
very  small  lines. 

Obstruction  Meters  (Venturi,  Flow  Nozzle,  Orifice)  -  The  basic 
meter  is  placed  in  the  path  of  a  flowing  fluid  as  an  obstruction 
and  causes  localized  changes  in  velocity.  Concurrently  with 
velocity  change,  there  is  a  pressure  change,  with  the  minimum 
pressure  occurring  at  the  point  of  maximum  restriction  (and 
velocity) .  Thus  the  differential  pressure  across  the  maximum 
and  minimum  restrictions  is  proportional  to  the  fluid  flow 
through  the  meter.  High  accuracy  and  good  pressure  recovery 
are  the  primary  advantages  of  the  venturi.  These  are  offset, 
however,  by  considerably  greater  cost  and  space  requirements 
as  compared  with  the  orifice  and  nozzle.  The  orifice  is  inex¬ 
pensive  and  may  often  be  installed  between  existing  line 
flanges.  However,  its  pressure  recovery  is  poor  and  it  may  be 
damaged  by  pressure  transients  due  to  its  lower  physical 
strength.  The  flow  nozzle  possesses  the  advantages  of  the 
venturi,  except  that  it  has  lower  pressure  recovery  plus  the 
added  advantage  of  shorter  length.  It  is  expensive  compared 
with  the  orifice  and  is  sometimes  difficult  to  install  prop¬ 
erly. 

Thermal  Flow  Meter  -  When  an  electrically  heated  wire  element 
is  placed  in  a  flowing  stream,  heat  will  be  transferred  between 
the  two,  depending  on  a  number  of  factors,  including  the  flow 
rate.  The  element  consists  of  a  short  length  of  fine  wire 
stretched  between  two  electrode  supports.  Two  methods  are  em¬ 
ployed  to  measure  flow.  The  first  technique  uses  a  constant 
current  passing  through  the  sensing  wire.  Variation  in  flow 
results  in  changed  wire  temperature  and  therefore  changed  re¬ 
sistance  which  then  becomes  a  measure  of  flow.  The  second 
technique  employs  a  servo  system  to  maintain  wire  resistance 
and  resultant  wire  temperature.  In  this  case,  a  change  in  flow 
results  in  a  corresponding  change  in  electrical  current  which 
is  then  interpreted  as  a  flow  analog.  The  two  methods  are 
called  constant-current  and  constant- temperature ,  respectively. 

When  flow  past  the  wire  is  varying  with  time,  the  sensing 
element  response  will  lag  behind  the  actual  flow  fluctuations 
because  of  the  heat  capacity  of  the  wire.  To  a  considerable 
extent,  it  is  possible  to  compensate  for  this  lag  in  the  signal 
conditioning  circuitry.  When  a  constanc-current  system  is 
employed,  compensation  is  achieved  by  means  of  a  passive  net¬ 
work  of  inductance  and  resistance  or  capacitance  and  resistance 
or  through  use  of  a  suitable  transformer.  However,  compensa¬ 
tion,  adjusted  for  the  particular  flow  condition  being 
measured,  is,  in  general,  usable  only  for  fluctuations  moving 
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up  to  magnitudes  of  about  15  percent  of  the  mean  stream 
velocity . 

In  the  constant  temperature  technique,  compensation  forms  an 
inherent  part  of  the  basic  system.  The  sensing  element  is  in¬ 
corporated  in  an  electrical  bridge  whose  unbalance  is  employed 
as  a  measure  of  current  required  to  maintain  constant  wire 
temperature.  Fluctuations  of  the  required  current  thereby  be¬ 
come  a  measure  of  the  flow  variations.  An  advantage  of  this 
system  is  that  a  wide  range  of  conditionr  does  not  affect  the 
ability  of  the  system  to  provide  a  flat  response.  Another  very 
practical  advantage  is  that  the  system  provides  inherent  pro¬ 
tection  against  wire  burnout. 

Advantages  of  the  thermal  flow  sensing  technique,  regardless 
of  the  signal  conditioning  method  used,  are 

•  Simplified  redundancy  through  use  of  multiple  wire 
elements  in  parallel. 

•  Built-in,  functional  self-check  capability  due  to  large 
magnitude  step  function  of  current  flow  and  total 
resistance  if  sensing  wire  opens. 

•  Sensors  can  fit  into  relatively  small  diameter  oil  lines. 

•  High  sensitivity  to  flow  fluctuations. 

Temperature  Indication 

Temperature  sensing  techniques  which  may  find  application  in 
lube  system  diagnostics  are  infrared  sensors,  thermocouples 
and  thermistors.  The  infrared  sensor  and  thermocouples  would 
be  applied  to  diagnose  misoriented  lube  jets  on  critical  gears 
and  lube-starved  bearings,  respectively.  The  thermistors  (or 
resistance  thermometers)  could  be  used  to  measure  oil  cooler 
efficiency  by  monitoring  Tin,  Tout,  and  ambient  temperature. 


SENSOR  TECHNIQUES  FOR  VARIOUS  FAILURE  MODES 

Sensing  Techniques  for  Retention  and  Mounting  Hardware  Failure 
Modes 


Although  retention  and  mounting  hardware  failure  modes  may 
comprise  a  rather  large  percentage  of  the  total  gearbox  failure 
rate,  most  of  the  significant  modes  such  as  abnormal  wearing, 
cracking,  stripping,  breaking,  denting,  spalling,  working,  and 
fretting  are  causes  for  debris  generation  and  in  some  cases 
will  result  ’n  abnormal  shock  and  noise  levels  due  to  looseness 
of  retained  parts.  It  is  also  a  mandatory  design  requirement 
to  eliminate  safety-of-f light  failure  modes  through  self 
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retention  features  and  Murphy  proof  installation  procedures 
for  all  critical  parts.  For  these  reasons,  it  does  not  seem 
prudent  to  include  failure  warning  and  inspection  equipment  in 
the  gearbox  design,  but  rather  to  rely  on  debris-monitoring  and 
shock  detection  equipment  included  for  gear  and  bearing  failure 
modes . 

Sensing  Techniques  for  Nonrotating  Structure  Failure  Modes 

This  component  class  accounts  for  a  very  small  percentage  of 
the  total  failure  rate  and  is  a  design  requirement  to  eliminate 
safety-of-f light  failure  modes  such  as  cracks  in  load  bearing 
members.  The  remaining  failure  modes  are  mainly  corrosion  and 
indentation  of  finished  surfaces  that  can  be  detected  by  debris 
monitoring.  Cracks  in  oil  line  passages  should  be  eliminated 
through  design  and  test,  but  are  easily  detectable  by  visual 
inspection . 

Sensing  Techniques  for  Shafting  Failure  Modes 

Shafting  failures  generally  account  for  less  than  5  percent  of 
the  total  failures  in  a  gearbox  and  are  generally  confined  to 
three  modes:  cracks,  fretting,  and  wear.  The  fretting  and 
wear  generate  debris  which,  if  treated  with  a  radioactive 
tracer,  can  easily  identify  critical  component  failure.  Shaft¬ 
ing  cracks  should  be  eliminated  througn  design  and  test,  but  if 
the  shaft  is  impregnated  with  a  radioactive  gas  (i.e.,  kryptona 
tion) ,  there  is  some  chance  that  gasses  escaping  from  fatigue 
cracks  in  an  oil  mist  atmosphere  would  result  in  sufficient  lub 
ricant  radioactivity  to  activate  a  warning. 

Sensing  Techniques  for  Spline  Failure  Modes 

Splines  exhibit  failure  modes  very  similar  to  those  that  occur 
in  gearing  and  thus  are  best  monitored  by  similar  failure 
warning  and  inspection  techniques.  However,  due  to  the  fact 
that  critical  amounts  of  spline  debris  can  be  masked  by  the 
normal  wear  debris,  it  is  advisable  to  treat  splined  surfaces 
with  radioactive  tracers  in  order  to  differentiate  spline 
wear  particles  from  the  larger  amounts  of  other  wear 
particles . 

Sensing  Techniques  for  Clutch  Failure  Modes 

Clutch  failures  have  two  modes:  loss  of  drive  (slippage)  or 
failure  to  fully  disengage  (hang-up) .  The  first  mode,  slip¬ 
page,  is  a  safety-of-f light  malfunction  with  a  sufficiently 
low  o  to  warrant  failure  warning  capability.  The  second  mode, 
hang-up,  although  it  has  a  comparable  value  of  6,  is  not  by 
itself  a  safety-of-f light  malfunction. 
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For  clutch  hang-up  to  compromise  safety  of  flight,  there  must 
also  be  an  engine  failure  in  the  same  drive  path  and  the 
clutch  must  be  fully  seized  as  opposed  to  merely  dragging. 

The  value  of  0  for  this  series  of  conditions  is  quite  high 
and  there  is  no  evidence  to  support  a  B>1;  therefore  failure 
warning  is  not  required  for  the  hang-up  mode. 

Because  the  failure  mechanisms  leading  to  slippage  are  not 
well  understood,  monitoring  spalling,  breakage,  wear,  and 
galling  cannot  provide  a  sufficiently  accurate  failure  warn¬ 
ing  capability.  The  apparent  alternative  is  to  monitor  clutch 
performance  based  on  the  assumption  that  mini-slips,  not 
apparent  to  operational  personnel,  occur  with  increasing 
severity  prior  to  the  loss  of  function  to  a  degree  detectable 
by  flight  personnel.  This  technique  for  indicating  clutch 
life  can  be  called  clutch  slip  monitoring. 

In  slip  monitoring,  drive  element  rpm  and  driven  element  rpm 
are  monitored  by  a  comparitor  with  high  rpm  sensitivity.  For 
each  engagement  when  the  driver  element  rpm  momentarily  ex¬ 
ceeds  the  driven  element  rpm,  a  counter  records  the  event 
and  the  comparator  records  the  extent  of  slippage.  For  Y 
clutch  engagements,  the  area  uncer  the  curve  of  Figure  56 
will  have  a  recorded  value  which  can  be  compared  either  with 
the  similar  value  of  the  previous  N  clutch  engagements  or  a 
limit  value  (assumming  such  a  limit  value  can  be  determined 
by  test  and  operational  experience).  Hopefully,  the  rate  of 
increase  of  this  clutch  life  index  will  provide  an  indication 
of  useful  clutch  life. 


FAILURE  WARNING  AND  INSPECTION  SIGNAL  CONDITIONING  AND 
SIGNAL  FLOW  ANALYSIS 


Signal  Conditioning 


The  outputs  of  the  sensors  selected  for  failure  warning  and 
inspection  systems  are  not  generally  directly  compatible  with 
pilot  and  maintenance  displays  and  often  require  further  proc¬ 
essing  to  provide  meaningful  information  to  operational  person 
nel.  This  processing  includes  limit  detection,  variable  limit 
programming,  total  accumulation  circuitry,  accumulation  rate 
circuitry,  resistance  bridges  and  servo  loops,  signal  filters, 
damping  and  attenuation  networks,  excitation  and  demodulation 
circuitry,  and  signal  converters.  This  is  called  signal  condi 
tioning.  Broadly  stated,  a  signal  conditioner  is  any  process¬ 
ing  element  that  converts  raw  transducer  output  into  useful 
intelligence.  In  this  case  the  useful  intelligence  is  an 
analog  or  digital  electrical  circuit  parameter  that  corre¬ 
sponds  to  truth  values  of  specific  fault  statements  about  the 
monitored  gearbox.  A  simplified  example  is  illustrated  in 
Figure  57. 
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Signal  Flow  Analysis 


Once  the  signal  conditioning  is  determined,  all  the  possible 
combinations  of  true  or  false  fault  statements  must  be  listed 
and  evaluated.  Certain  combinations  will  be  self  contradicting 
and  indicative  of  sensor  or  signal  conditioning  failures.  Some 
combinations  will  be  possible  but  highly  unlikely;  therefore 
they  are  unsuitable  for  conclusive  failure  warning  and  inspec¬ 
tion.  The  remaining  combinations  will  correspond  to  sets  of 
monitored  conditions  which  are  highly  indicative  of  specific 
failure  modes  within  the  transmission.  These  combinations  (as 
well  as  the  self-contradictory  sets)  can  be  analyzed  by  a  hard¬ 
wired  logic  network  or  a  computer  which  activates  the  appropri¬ 
ate  failure  warning  or  inspection  display.  The  process  of 
generating  (  xl  possible  combinations  of  fault  statement  values, 
evaluating  their  meanings,  and  synthesizing  the  appropriate 
logic  network  is  referred  to  as  signal  flow  analysis.  Figure 
58  is  an  example  corresponding  to  the  signal  conditioning  of 
Figure  57.  Since  there  are  six  fault  statements,  each  which 
can  be  either  true  or  false,  the  number  of  possible  combina¬ 
tions  is  2 6  =  64.  For  brevity,  the  logic  corresponding  to 
only  12  of  these  combinations  is  shown. 
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Figure  58.  Sample  Signal  Flow  Analysis. 
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APPENDIX  IV 

TESTING-RELATED  CRITERIA 


INTRODUCTION 

The  intent  of  this  section  is  to  identify  the  role  of  testing 
in  an  on-condition  transmission  evaluation.  Various  con¬ 
straints  that  affect  the  establishment  of  transmission 
developmental  test  plans  are  discussed  with  regard  to  their 
impact  upon  the  early  substantiation  of  transmission  on- 
condition  potential.  The  impact  of  overload/accelerated 
testing  upon  on-condition  substantiation  is  discussed. 
Finally,  a  discussion  cn  the  types  and  sizes  of  test  programs 
necessary  to  substantiate  on-condition  potential  is  provided. 


SUMMARY 

The  great  variability  in  hazard  function  parameters  that  is 
exhibited  by  small  random  samples  has  led  to  the  conclusion 
that  developmental  testing  is  of  little  value  in  affirming  or 
denying  the  existence  of  a  high  6  parameter. 

The  primary  value  of  developmental  testing  from  an  on-condition 
aspect  lies  in  the  identification  of  failure  modes  and 
establishment  of  failure  mechanisms  which  facilitate  redesign 
to  eliminate  the  mode  when  possible.  Furthermore,  develop¬ 
mental  testing  can  be  of  great  value  in  establishing  failure 
progression  rates  for  critical  components. 

The  manner  in  which  on-condition  operation  can  be  most 
profitably  supported  through  developmental  testing  is  by  the 
establishment  of  a  truly  adequate  reliability  test  program. 

It  is  postulated  that  improving  reliability  will  of  necessity 
also  enhance  on-condition  potential. 


ROLE  OF  TESTING  IN  ON-CONDITION  EVALUATIONS 


Testing  impacts  an  on-condition  analysis  in  the  following 
three  ways: 

•  Establishment  of  failure  mechanisms 

•  Establishment  of  failure  progression  rates 

•  Determination  of  modal  hazard  functions 

The  succeeding  paragraphs  will  discuss  these  three  points  in 
detail. 
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Establishment  of  Failure  Mechanisms 

Rumme 1 ,  in  his  recent  Army  study,  HELICOPTER  DEVELOPMENT  RELI¬ 
ABILITY  TEST  REQUIREMENTS,  has  indicated  that  high  transmission 
reliability  is  rarely,  if  ever,  achievable  as  the  design  comes 
off  the  drawing  board.  Rather,  high  reliability  is  achieved 
through  a  process  of  problem  identification  through  testing 
and  subsequent  redesign  to  eradicate  or  reduce  the  problem. 

This  process  generates  the  phenomenon  currently  referred  to  as 
reliability  growth. 

The  steps  which  result  in  reliability  growth  analogously  gen¬ 
erate  an  improvement  in  gearbox  on-condition  potential.  That 
is,  elimination  of  failure  modes  detected  during  developmental 
testing  will  undoubtedly  eradicate  some  modes  which  are  on- 
condition  limiting. 

In  testing  to  enhance  or  substantiate  on-condition  capability, 
special  attention  should  be  focused  on  the  elimination  of 
modes  which  could  be  undetectable  in  an  aircraft,  potentially 
catastrophic,  quickly  progress  to  a  catastrophic  mode,  or  have 
high  8  parameter. 


Establishment  of  Failure  Progression  Rates 


Gearinc 


Use  of  carburized  steel  has  significantly  reduced  crack- 
propagation  rates  for  gears  in  wnich  it  is  applied. 

Recent  fail-safe  design  criteria  have  identified  crack- 
propagation  times  greatly  in  excess  of  30  hours  as  being 
state  of  the  art.  Thus,  there  would  appear  to  be  adequate 
time  in  which  to  detect  gear  fatigue  failures  before  they 
progress  to  a  catastrophic  stage.  This  is  the  case  pro¬ 
vided  that  some  form  of  detection  sensor  (shock  detector, 
vibration  analysis,  etc.)  is  employed  in  the  transmission. 
It  appears  that  gear  progression  rates  are  slow  enough  to 
be  detected  through  a  ground-based  signal-analyzing 
system. 


Surface-initiated  gear  failures  such  as  scuffing  and  pit¬ 
ting  have  ver-y  slow  progression  rates  (much  greater  than 
30  hours).  Furthermore,  they  are  normally  detectable 
through  debris-monitoring  systems.  Thus  the  potential  for 
a  surface  distress  problem  progressing  to  a  catastrophic 
tooth  failure  seems  very  remote. 


The  following  data  taken  from  a  test  report  on  the  CH-46 
helicopter  aft  transmission  demonstrates  typical  gear 
failure  progression  time.  During  the  test  program,  a  test 
log  was  maintained  which  retains  a  permanent  record  of  all 
pertinent  test  data.  Inspections  of  the  magnetic  plug 
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and  filters  were  made  at  specified  intervals  during  the 
test.  At  these  intervals,  debris  from  the  filter  and 
magnetic  plugs  was  retained  as  a  permanent  part  of  the 
test  log  at  the  specified  test  hours  before  each  inspec¬ 
tion.  During  this  specific  test,  chips  were  first 
detected  at  23  test  hours  from  inspection  of  the  magnetic 
plug;  additional  chips  were  detected  on  the  magnetic 
plug  at  42  test  hours.  Metallic  debris  was  detected  from 
inspection  of  the  filters  at  test  intervals  of  56,  61, 

131,  136,  141,  146,  and  150  hours.  Metallurgical 
evaluation  of  the  chips  from  this  test  established  that 
they  were  from  the  gears  in  this  transmission.  Visual 
inspection  of  these  chips  confirmed  the  fact  that  their 
geometric  shape  and  general  appearance  were  typical  of 
debris  associated  with  a  normal  spalling-type  gear  failure. 
Therefore,  it  is  logical  to  assume  that  the  first  indica¬ 
tion  of  chips  at  23  test  hours  can  be  considered  as  the 
point  of  incipient  failure.  The  period  from  this  point 
to  the  conclusion  of  the  test  run  could  be  considered  as 
the  remaining  useful  life. 

Bearings 

Experience  on  ball  and  roller  bearings  has  shown  that 
progression  from  incipient  spall  to  the  point  of  detect¬ 
ability  through  standard  debris-monitoring  systems  is 
generally  in  excess  of  50  and  200  hours  for  ball  and 
roller  bearings,  respectively.  Figure  59  shows  a  pro¬ 
gression  time  of  250  hours  for  a  CII-47  input  pinion 
roller  bearing. 

A  test  program  was  conducted  to  evaluate  the  progression 
rate  characteristics  of  the  CH-47  aft  rotor  thrust  bearing 
deterioration  which  resulted  in  eventual  failure  of  this 
bearing.  The  specimens  tested  are  ball  thrust  bearings, 
part  no.  114DS342.  These  bearings  have  bronze  cage?  and 
split  inner  races.  A  pretest  history  consisted  of  the 
following: 

•  Serial  No.  57  (-1  Bearing)  -  This  bearing  was  received 
from  the  field  after  506  hours  35  minutes  flight 
time.  Field  damage  consisted  of  a  3/4-inch-long  spall 
on  the  inner  race. 

•  Serial  No.  52  (-1  Bearing)  -  This  bearing  was  received 
from  the  field  after  338  hours  flight  time.  No  field 
damage  was  evident. 

•  Serial  No.  25  (-2  Bearing)  -  This  bearing  was  taken 
from  new  stock  at  random. 
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To  accomplish  the  objectives  of  this  test  program,  a 
special  back-to-back  test  stand  was  designed  and  fabricated 
consisting  of  a  structural  framework,  drive  system,  and 
lubrication  system.  The  bearings  were  installed  in  a 
dummy  rotor  shaft  assembly. 

During  the  duration  of  the  test  runs,  the  various  instru¬ 
mentation  devices  were  monitored  every  half-hour  and 
values  for  oil  pressure  and  temperature,  rod  tension, 
upper  and  lower  housing  temperatures,  and  run  time  were 
recorded  in  the  test  log.  Oil  and  chip  samples  were 
taken  at  the  discretion  of  the  test  engineer  for  each 
workday  shift  and  sent  to  tne  material  and  process 
laboratory  for  analysis. 

approximately  10  hours  before  failure  (seizure)  occurred, 
the  spectrographic  analysis  of  the  oil  indicated  a  rapid 
increase  in  iron,  copper,  and  aluminum  content.  The  chip 
detectors  used  in  the  test  were  very  effective  in  shoiving 
significant  chip  buildup  early  in  the  test  runs. 

However,  when  chips  were  being  produced  at  a  rapid  rate, 
the  chip  detector  shutdown  circuit  created  a  problem 
because  shutdown  would  occur  too  frequently. 

The  results  of  this  test  program  (Table  XXXV)  demonstrated 
a  definite  and  repeatable  fatigue  failure  progression  rate 
in  the  114DS342  bearing.  Failure  began  with  spalling  on 
the  inner  race,  followed  by  ball  spalling,  cage  wear,  and 
damage  to  the  outer  race,  followed  by  ball  fracture  and 
fracture  of  the  inner  and  outer  races.  The  failure  of  the 
cage  and  outer  race  was  secondary  in  nature  although  it 
contributed  to  the  eventual  seizure  of  the  bearing. 

Shafting,  Clutches,  Etc. 

Little  test  data  on  failure  progression  rates  for  these 
component  classes  is  available.  However,  enough  of  these 
failure  modes  have  been  observed  in  high-time  and  failed 
gearboxes  that  it  is  generally  felt  that  these  components 
progress  to  a  catastrophic  mode  at  a  slow  enough  rate 
that  they  would  be  detectable  via  airborne  or  ground 
diagnostic  systems. 


Determination  of  Modal  Hazard  Functions 


The  data  presented  in  Table  XLIII  of  Appendix  VIII  shows  a 
rather  significant  spread  in  6  Vciiues  over  the  four  gearboxes 

important,  when  evaluating  the 
a  new  design,  to  use  the  data  on  the 
transmission  most  similar  to  the  configuration  oeing  evaluated. 
Furthermore,  for  the  sake  of  being  conservative,  test  data 


of  the  CH-47.  Thus  it  is 
on-condition  potential  of 
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TABLE  XXXV.  BACK-TO-BACK  TEST  STAND  RESULTS 
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should  be  analyzed  to  ensure  that  the  &  values  predicted  for 
gearbox  modes  are  being  exhibited  by  the  new  design.  Thus  the 
test  results  should  always  be  evaluated  to  identify  any  high 
g  modes  unique  to  the  transmission  under  consideration. 

Conversely,  testing  can  show  that  a  mode  which  generally 
exhibits  a  high  3  has  a  significantly  reduced  3  in  the  design 
being  considered.  This  could  result  in  the  elimination  of 
some  modes  from  the  on-condition  limiting  category. 

It  is  anticipated,  however,  that  a  fairly  large  sample  size  is 
necessary  before  very  much  faith  can  be  put  in  the  g  values 
derived  from  test  results. 

ACCELERATED/OVERLOAD  TESTING 

The  effect  of  speed  and  load  upon  reliability  is  considered  in 
the  B10  equations  for  bearing  life.  That  is, 

/CAPACITY \  e  .  16667 
B  _  V  LOAD  / _ 


where  N  =  speed  in  rpm 

e  =  10/3  for  roller  bearings,  9/3  for  ball  bearings. 

However,  recent  work  on  the  CH-47  helicopter  has  shown  that  the 
effect  of  power  upon  transmission  failure  rate  may  be  signi¬ 
ficantly  greater  than  a  cubic  effect.  Figure  60  is  a  plot  of 
failure  rate  versus  cubic  mean  loads  for  three  configurations 
and  power  ratings  of  the  CH-47  forward  and  aft  gearboxes. 

Plots  have  been  made  for  various  bearings  and  gears  within  the 
assemblies. 

These  plots  indicate  that  the  effect  of  power  upon  failure  rate 
is  not  very  well  understood  in  a  quantitative  sense.  The  same 
statement  should  be  made  about  the  effect  of  speed  of  testing 
upon  failure  rate.  Thus  it  appears  that  overload/accelerated 
tests  are  of  primary  value  in  expediting  the  identification 
of  failure  modes  and  mechanisms,  rather  than  establishing 
absolute  failure  rates;  it  should  be  reiterated  here  that 
quantitative  evaluation  of  the  results  of  overload/accelerated 
tests  is  extremely  hazardous  due  to  our  lack  of  understanding 
of  the  K  factor  relating  power  to  failure  rate. 

TEST  SIZE 

In  order  to  evaluate  the  viability  of  using  the  Weibull 
distribution  for  making  fleet  projections  from  sample  estimates, 
the  simulation  model  explained  in  Appendix  V  was  used.  More 


than  60  simulation  runs  wer°  made  using  the  following 
parameters : 


Months/ 

Periods 

Units 

Utilization  Per 
Month/Period 

Input 

8 

Input 

e 

36 

3 

60 

0.5 

100 

5 

120 

1.0 

500 

10 

2.0 

1,000 

3.0 

2,000 

The  important  aspect  to  be  examined  was  not  necessarily  that 
the  observed  6  predict  exactly  or  even  very  closely  the  true  B , 
but  rather  that  increasing  hazard  rates  manifest  themselves  as 
such  and  not  be  misconstrued  as  decreasing  or  constant  failure 
rates.  One  of  the  constraints  experienced  in  this  exercise 
was  that  it  took  certain  amounts  of  simulated  time  to  develop 
enough  failures  for  what  were  considered  to  be  valid  uses  of 
the  least-squares  fit  method.  A  minimum  of  four  data  points 
were  deemed  necessary  for  the  calculated  parameters  to  be 
useful. 

In  nearly  all  cases  of  true  8  greater  than  1.0,  the  observed  8 
was  greater  than  1.0.  However,  in  the  cases  of  true  8  less 
than  1.0,  specifically  0.5,  observed  6  tended  to  be  above  1  at 
times,  and  high  utilizations  to  accumulate  greater  hours  and 
additional  failures  had  to  be  employed  to  generate  observed  B's 
less  than  1.  In  general,  observed  8  was  nearly  always  higher 
than  true  8,  at  times  to  a  large  degree.  Consequently,  when 
using  the  Weibull  distribution  to  estimate  8 ,  during  testing 
the  observed  8  will  be  higher  than  true  8  to  an  even  greater 
extent  than  previously  discussed  in  Appendix  V. 

A  stepwise  multiple  regression  analysis  was  considered  using 
the  testing  simulation  data  to  develop  a  predicting  equation  to 
modify  the  observed  3  into  a  better  estimate  of  the  true  3, 
but  this  was  discarded  due  to  the  wide  variations  in  the  data. 

It  is  possible  that  additional  work  in  this  area  could  yield  a 
satisfactory  method  of  converting  the  6  generated  by  the 
Weibull  distribution  into  a  more  satisfactory  estimate;  however, 
the  work  involved  was  considered  too  extensive  with  respect  to 
the  relationship  of  this  area  to  the  rest  of  the  study.  It 
seems  that  the  inability  of  this  method  to  predict  well  lies 
in  the  inherent  limitations  of  the  method  due  to  the  small  size 
of  the  data  base.  It  should  be  remembered  nonetheless  on  the 
positive  side  that  true  8's  of  greater  than  1  are  observed  as 
such. 

The  predicting  equation  explained  previously  in  Appendix  V  can 
be  used  to  modify  8  if  desired.  However,  due  to  variations 
seen  at  the  lower  end,  i.e.,  few  failures,  it  should  be  used 
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prudently,  tempered  with  engineering  judgment,  based  on 
qualitative  test  data  combined  with  knowledge  of  historical 
hazard  functions. 

An  alternative  use  of  the  failure  data  obtained  in  testing  is 
to  compare  the  failure  modes  witn  modes  observed  in  similar 
transmissions  and  the  generic  failure  modes  shown  in  Appendix 
VIII.  From  these,  the  historical  hazard  functions  for  the 
modes  observed  in  test  can  be  found  and  combined  into  an 
assembly  hazard  function.  This  can  then  be  compared  with  the 
predicted  assembly  hazard  function  and  appropriate  revisions 
made  in  the  prediction. 

Thus,  due  to  the  poor  correlation  of  test  data  with  the 
theoretical  distribution,  very  little  quantitative  faith  should 
be  put  in  the  results  of  the  test.  In  order  to  optimize 
transmission  on-condition  potential  via  testing,  it  is 
recommended  that  the  test  planner  define  the  best  test  program 
possible  from  the  pure  reliability  sense,  considering  the  con¬ 
straints  of  calendar  time,  test  specimen  availability,  test 
technique  effectiveness,  etc.  It  is  anticipated  that  the 
development  of  a  good  test  program,  in  the  reliability  sense, 
is  the  best  way  to  improve  on-condition  potential  through 
testing. 
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APPENDIX  V 

METHODS  OF  EVALUATING  FAILURE  DATA 


INTRODUCTION 

The  intent  of  this  section  is  to  identify  and  review  several 
methods  for  evaluating  failure  distributions  that  are  employed 
throughout  the  helicopter  industry,  and  to  draw  conclusions 
regarding  the  method  most  applicable  to  the  rigorous  quanti¬ 
fication  of  hazard  functions  intrinsic  to  the  evaluation  of 
on-condition  operation  of  helicopter  transmissions. 


SUMMARY 

There  are  probably  almost  as  many  different  methods  of  evalu¬ 
ating  failure  data  as  there  are  reliability  organizations 
within  the  various  segments  of  the  military  and  industrial 
communities.  In  order  to  present  a  cross  section  of  methods 
relevant  to  this  study,  the  techniques  employed  at  Bell, 
Sikorsky,  Massey  Ferguson,  and  Boeing  Vertol  have  been  evalu¬ 
ated.  It  is  felt  that  the  products  of  these  companies  are 
representative  of  the  majority  of  Army  helicopter  transmission 
applications . 

Two  of  these  methods  fail  to  quantify  the  hazard  function  if 
it  is  nonconstant  and  hen^e  were  rejected  since,  as  previously 
stated,  rigorous  quantification  of  the  hazard  function  is  the 
nucleus  of  the  analysis  of  on-ccndition  operation. 

The  remaining  two  methods  both  satisfactorily  quantify  the 
hazard  function.  Both  use  a  form  of  Weibull  paper  to  estimate 
the  hazard  function  parameter  and  both  yield  equally  precise 
results.  Since  one  method  involves  a  geometric  construction 
that  is  slightly  easier  than  the  other,  it  was  selected  as  the 
preferred  method  for  this  study. 


REVIEW  OF  METHODS 

The  discussion  presented  on  the  following  pages  will  deal  with 
each  of  the  methods  independently. 

Bell 

Bowen,  in  his  paper,  ANALYSIS  OF  TRANSMISSION  FAILURE  MODES  , 
states  that, 

"Although  the  existence  of  a  constant  failure  rate 
for  a  developed  production  system  has  often  been 
used  by  reliability  engineers,  our  statistics  do 
not  support  this  conclusion." 
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Thus,  to  evaluate  the  validity  of  the  assumption  of  exponen- 
tiality,  the  method  demonstrated  in  Figure  619  is  employed  by 
Bell. 

Although  one  can,  upon  inspection,  identify  the  areas  where 
the  failure  rate  is  nonconstant,  this  identification  is  more 
qualitative  than  quantitative.  The  failure  rate  is  noncon¬ 
stant  when  the  slope  of  the  failure  data  is  not  parallel  to 
the  constructed  line.  This  lack  of  quantification  renders 
this  method  unacceptable  to  the  requirements  of  mathematical 
rigor.  Rather,  this  method  is  useful  to  identify  areas  of 
nonconstant  failure  rate  which  should  be  investigated  further 
for  causality. 


Sikorsky 


Sikorsky's  method  is  essentially  the  same  as  that  employed  by 
Bell.  One  point  of  possible  difference,  although  Bell  may 
also  use  this  technique,  is  in  the  construction  of  confidence 
limits  on  the  constant-failure-rate  line,  as  shown  in  Figure 
62. 


Here  the  null  hypothesis  is  that  the  transmission  does  in  fact 
have  a  constant  failure  rate,  v^hich  will  be  accepted  unless 
the  data  violates  the  confidence  limit. 


One  problem  with  this  method  is  that  it  allows  for  significant 
variations  in  slopes  over  segments  of  time,  without  the  rejec¬ 
tion  of  the  hypothesis  of  exponentiality .  Furthermore,  as  in 
the  Bell  method,  quantification  of  the  amount  of  nonexponen- 
tiality  is  not  provided.  Thus,  this  method  does  not  meet  the 
requirements  of  this  study. 


One  additional  point  should  be  made  regarding  the  use  of  the 
hypothesis  of  exponentiality.  This  hypothesis  places  the  burden 
of  disproof  upon  the  data.  What  can  be  considered  minor  devia¬ 
tions  in  the  statistical  sense  may  be  rather  significant  in  the 
engineering  sense  if  the  transmission  does  in  fact  have  a  noncon¬ 
stant  failure  rate.  Thus  the  hypothesis  of  exponentiality  which, 
as  is  the  case  in  most  hypothesis  testing,  is  difficult  to  dis¬ 
prove  without  major  deviations,  may  be  unduly  optimistic.  In  order 
to  preserve  conservative  design  and  analytical  practices,  it  would 
appear  better  to  take  the  approach  of  assuming  an  increasing  rate 
of  failure  and  then  require  that  the  data  disprove  this  assumption. 


This  method  is  the  same  as  that  employed  at  Boeing  Vertol  ex- 
ceDt  for  one  minor  difference.  The  paper  employed  by  Massey 
Ferguson12 in  Figure  63  is  standard  Weibull  paper  which  requires 
construction  of  a  parallel  line  through  the  estimation  point 
to  estimate  the  Weibull  slope  parameter.  The  Vertol  paper 
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Figure  63.  Massey  Ferguson  Weibull  Plot  on  Standard 
Weibull  Paper. 


uses  construction  of  a  perpendicular  line  to  estimate  6. 
Selection  of  the  Vertol  method  over  the  Massey  Furguson  method 
is,  therefore,  just  a  matter  of  personal  preference. 

The  details  of  this  method  are  discussed  under  the  Boeing 
Vertol  heading  due  to  their  similarity. 

Boeing  Vertol 

The  method  employed  at  Boeing  Vertol  for  determining  transmis¬ 
sion  failure  distribution  assumes  the  Weibull  distribution  to 
be  the  mathematical  expression  underlying  the  sample  of  fail¬ 
ure  data.  In  the  section  entitled  THE  CONCEPT  OF  ON-CONDITION 
OPERATION,  a  discussion  was  presented  of  the  manner  in  which 
failure  data  is  plotted  on  the  Boeing  Vertol  Weibull  paper  and 
how  estimates  of  3  and  6  are  made. 

The  Vertol  method  allows  for  quantifying  $  and  6  with  the  best 
estimates  available  from  the  data.  Furthermore,  data  can  be 
transformed  using  binomial  transforms  or  median  ranks  into  50- 
percentile,  90-percentile,  95-percentile  (or  whatever)  esti¬ 
mates  to  develop  confidence  intervals  on  6  and  0.  Finally,  in 
applying  this  method  if  one  line  does  not  adequately  fit  the 
data,  different  lines  (and  therefore  different  distributions) 
can  be  employed  over  different  segments  of  time.  This  feature 
becomes  important  when  working  with  data  that  has  several 
severely  dominating  but  transient  modes  of  failure  which  drive 
the  slope  of  the  line  for  short  periods  of  time  and  then 
subside. 

A  Vertol-developed,  computerized,  least-squares  regression 
program,  which  calculates  6  and  0  from  inputted  failure  and 
scheduled-removal  data,  can  be  found  in  the  Program  Documen¬ 
tation  Volume  of  this  study.  An  example  of  the  Weibull  paper 
used  at  Boeing  Vertol  is  shown  in  Figure  64. 

EFFECT  OF  SAMPLE  SIZE  ON  HAZARD  FUNCTION  PARAMETERS 


Introduction 


The  intent  of  this  section  is  to  develop  equations  which  can 
be  used  to  estimate  true  values  for  3  and  0 ,  based  on  a 
limited  sample  of  data  from  on-condition  operation.  A  com¬ 
puter  simulation  was  developed  to  generate  the  data  necessary 
for  the  performance  of  this  analysis  and  is  discussed  in  de¬ 
tail  in  this  section. 

Literatu re  Search  of  Effect  of  Sample  Size  on  3  and  0 

The  variation  of  sample  estimates  as  a  function  of  sample  size 
has  been  acknowledged  by  reliability  engineers  and  statisticians 
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Figure  64.  Boeing  Vertol  Weibull  Plot  On  Modified  Weibull 


alike.  M.  V.  Menon  in  his  paper,  ESTIMATION  OF  THE  SHAPE  AND 
SCALE  PARAMETERS  OF  THE  WEIBULL  DISTRIBUTION13,  discusses  meth¬ 
ods  of  estimating  expected  variation  in  0  and  0  as  a  function 
of  sample  size. 

L.  G.  Johnson  in  his  textbook 14  recognizes  the  effect  of  sample 
size  upon  0  and  8  and  has,  in  fact,  developed  confidence 
limits  on  0.  These  confidence  limits  are  shown  in  Figures  65 
and  66. 

Fundamental  to  the  davelopment  of  estimates  of  0  variation  or 
confidence  limits  of  0  in  the  methods  of  Menon  or  Johnson  is 
the  assumption  of  sampling  from  a  static,  infinite  population. 
Thus,  as  would  be  expected  by  any  statistician  knowledgeable 
of  the  Central  Limit  Theorem,  estimates  will  be  normally  dis¬ 
tributed  around  the  true  value  of  0.  However,  in  the  case  of 
a  finite,  dynamic  population  (such  as  a  fleet  of  helicopter 
transmissions) ,  the  assumption  of  normality  may  not  be  valid. 

The  results  of  the  simulations  detailed  in  the  following  pages 
tend  to  dispute  this  assumption  for  application  to  a  helicopter 
transmission;  that  is,  one  almost  invariably  overestimates  the 
true  value  of  0  when  the  estimate  is  based  on  a  finite  sample 
of  data.  Thus  the  equations  generated  in  the  following  pages 
seem  more  applicable  for  transforming  0  estimates  into  true  6 
values  for  helicopter  transmission  applications. 

Analysis  of  Hazard  Function 

The  hazard  function  for  an  item  describes  how  the  failure  rate 
changes  as  operating  time  increases.  It  is  a  conditional  ex¬ 
pression  which  states  that  if  the  item  reaches  a  certain  oper¬ 
ating  time  it  will  have  the  indicated  failure  rate.  Once  the 
0  and  6  parameters  of  the  Weibull  distribution  are  known  for  a 
set  of  data,  the  hazard  function  can  be  constructed  from  the 
equation  in  the  section  entitled  THE  CONCEPT  OF  ON-CONDITION 
OPERATION. 

The  importance  of  the  hazard  function  has  been  recognized,  since 
it  provides  a  basis  for  deciding  whether  to  impose  a  TBO  and 
cause  component  removal,  or  to  allow  it  to  continue  to  operate 
and  be  exposed  to  its  future  failure  rate.  For  this  reason  it 
was  felt  that  this  area  should  be  examined  in  detail,  to  deter¬ 
mine  the  effect  of  sample  size  on  the  parameters  of  the  hazard 
function,  and  to  develop  a  method  of  projecting  sample  esti¬ 
mates  into  fleet  estimates. 


Computer  Sir.ulation  of  Fleet  Operation 


Xn  to  properly  analyze  the  behavior  of  the  hazard  func¬ 

tion  under  varying  circumstances,  a  large  base  of  component 
failure  and  removal  data  was  necessary.  The  data  had  to  con¬ 
tain  numbers  of  removed  items  with  their  respective  operating 
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Figure  66.  Ninety  Percent  Error  of  6  as  a  Function  of 


hours  at  time  of  removal,  total  items  in  the  population,  total 
fleet  operating  time,  and  other  pertinent  information.  Al¬ 
though  some  data  of  the  kind  required  was  available,  it  was 
not  always  in  the  proper  form  or  of  the  quality  and  quantity 
needed  for  this  analysis.  Therefore  a  computer  simulation 
model  was  developed  to  generate  data  quickly  and  efficiently 
and  of  sufficient  variation  for  the  purposes  of  this  study. 

To  analyze  the  role  of  hazard  function,  the  model  was  exer¬ 
cised  in  the  following  manner.  A  fleet  of  100  components  was 
put  into  operation  in  the  first  time  period.  Hours  of  opera¬ 
tion  for  each  component  for  the  time  period  were  then  randomly 
selected  from  a  uniform  distribution  around  a  mean  utilization 
which  is  input  to  the  program.  In  succeeding  time  periods  the 
hours  were  added  to  the  total  operating  time  on  each  component 
The  change  in  the  unreliability  resulting  from  the  increase  in 
operating  time  was  calculated  for  each  component,  using  time 
and  inputted  ts  and  0 .  (The  6  and  0  inputs  to  the  program  are 
used  to  generate  failures  according  to  component  time,  but 
these  failures  are  later  ordered  and  a  8  and  0  for  this  sample 
are  estimated.)  The  changes  in  unreliability  for  the  individ¬ 
ual  items  were  summed,  with  the  total  representing  the  number 
of  failures  which  were  expected  during  this  time  period.  The 
program  then  called  a  subroutine  which  weighted  each  item 
according  to  its  hazard  rate,  so  that  the  components  with  the 
highest  instantaneous  probability  of  failure  had  the  greatest 
chance  of  b°\ng  selected  as  failures  for  the  time  period.  The 
weighted  failures  were  then  selected  at  random  and  replaced 
with  zero-time  components.  The  next  subroutine  ordered  the 
failures  and  calculated  3  and  0  according  to  the  method  of 
least-squares  on  transformed  data.  Output  was  printed  for 
this  period  and  the  program  repeated  the  whole  process  for  the 
next  time  period. 

A  simple  flow  chart  of  the  model  in  this  mode  of  operation  is 
shown  as  Figure  67.  The  equations  used  in  the  model  and  a 
detailed  discussion  of  the  program  appear  in  the  Program  Docu¬ 
mentation  Volume  of  this  report. 

Use  of  the  Model 


Looking  at  the  model  from  a  different  viewpoint  for  a  moment, 
one  sees  the  user  assuming  the  role  of  a  reliability  engineer. 
He  receives  data  describing  the  operation  of  a  fleet  of  compo¬ 
nents:  time  period,  total  operating  hours,  number  of  failures 

hours  on  the  failed  items,  the  8  and  0  parameters,  and  so 
forth.  From  this  he  evaluates  fleet  performance. 

However,  the  model  was  used  in  this  portion  of  the  analysis  to 
study  the  parameters  of  the  hazard  function.  8  and  0  were 
inputs  to  the  program  and  were  used  to  generate  failures. 

These  were  the  true  values  of  the  failure  data,  but  due  to 
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Figure  67.  Flow  Chart  of  Mathematical  Model  of  Component 
Fleet  Operation. 
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small  sample  size  and  clustering  of  the  data  as  occurs  in 
actual  fleet  operations,  the  calculated  0  and  6  which  a  reli¬ 
ability  engineer  would  observe  may  or  may  not  indicate  the 
true  values.  The  calculated  values  were  plotted  and  analyzed 
over  time  and  with  increasing  sample  size  and  were  compared 
with  the  true  input  values  to  determine  the  relationship  be¬ 
tween  the  true  and  observed  values.  The  input  3  and  0  param¬ 
eters  were  then  changed  to  see  if  the  relation  between  true 
and  observed  values  was  consistent.  Furthermore,  the  utiliza¬ 
tion  was  altered  to  determine  its  effect.  The  resulting  data 
was  then  correlated  with  the  intent  of  having  a  method  of  pre¬ 
dicting,  from  the  observed  0  and  e  for  a  given  sample  size, 
the  true  6  and  0  parameters  of  the  hazard  function.  From  this 
exorcise,  insight  was  gained  into  the  effect  of  sample  size 
upon  these  parameters. 

Resul ts 

A  large  number  of  simulation  runs  were  made,  with  0's  of  0.5, 
0.75,  1.0,  1.5,  and  2.0.  These  were  felt  to  be  reasonable, 
accounting  for  a  decreasing  (infant  mortality)  failure  rate, 
a  constant  (random)  failure  rate,  and  an  increasing  (wearout) 
failure  rate.  0's  used  were  i,000,  3,000,  3,500,  and  6,000 
hours.  Utilization  was  either  60  or  180  hours  per  period. 
Output' was  requested  at  varying  intervals,  from  as  "frequently 
as  every  6  periods  to  every  18  periods.  Each  run  comprised 
108  periods. 

A  typical  page  of  output  is  shown  in  Figure  68.  Input  3  and  0 
for  the  run  were  1.0  and  6,000  hours,  respectively.  As  can  be 
seen,  at  the  end  of  18  periods,  17  failures  had  been  generated, 
and  the  observed  3  and  0  for  this  sample  were  1.6078  and  555.8 
hours.  The  term  cumulative  MTBUR  is  used  for  the  statistic 
employed  as  a  sample  estimate  of  the  true  MTBUR.  Cumulative 
MTBUR  is  calculated  by  dividing  the  total  number  of  failures 
into  the  total  number  of  hours  on  removed  components.  As  such 
it  should  probably  be  labeled  MTTUR  not  MTBUR  to  be  consistent 
with  standard  reliability  terminology.  It  can  be  demonstrated, 
however,  that  the  statistic  cumulative  MTBUR, as  defined  herein, 
is  in  fact  an  unbiased  estimate  of  the  true  MTBUR,  although 
for  small  sample  sizes  it  is  generally  significantly  lower 
than  true  MTBUR.  True  MTBUR  is  calculated  by  taking  all  the 
hours  on  all  the  gearboxes  in  the  fleet,  both  removed  and  still 
running,  and  dividing  by  the  total  number  of  failures. 

In  this  run,  as  sample  size  increases  3  decreases,  approaching 
the  true  3  of  1.0,  and  0  increases  in  the  direction  of  the 
true  0  of  6,000  hours.  A  plot  of  all  the  data  points  gener¬ 
ated  using  a  true  3  of  1.0  appears  as  Figure  69.  This  shows 
observed  3  versus  number  of  failures  (sample  size).  This  data 
was  also  plotted  as  observed  3  versus  fleet  operating  hours  in 
Figure  70.  This  process  was  repeated  for  the  various  0's, 
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6's,  and  utilizations,  resulting  in  over  200  data  points. 

These  points  were  employed  in  developing  the  equations  shown 
in  the  succeeding  paragraphs  of  this  section. 

The  next  step  in  this  phase  of  the  study  was  to  correlate  the 
data,  in  order  to  discover  which  parameters  were  related  and 
would  therefore  prove  useful  in  developing  a  predictive  tech¬ 
nique.  For  this  work  a  stepwise,  multiple-regression  program 
was  used.  This  program  enables  the  user  to  input  a  set  of 
data  and  specify  the  dependent  variable  and  the  independent 
variables  to  be  used  in  each  sub-problem  of  the  program.  Each 


INPUTS  :  TBO  <99999,  THETA  6000.,  MONTHS  103,  UTIL.  60.,  eel*  l  .00 

28  ETA  1.00,  2  THETA  6000.,  2  TBO  99999. 


PERI00  18 
HOUR S  CUMULATIVE  107450 
SCMEO.  REMS.  CUMULATIVE  0 
FAILURES  CUMULATIVE  17 

Cumulative  mtbur  518 

TRUE  MTBUR  6320 
BETA  1.6078 
TmETA  55S.8 
C0RR.  COEFF.  0.9924 


PERIOD  36 
HOURS  CUMULATIVE  213365 
SCmEO.  REMS.  CUMULATIVE  0 
FAILURES  CUMULATIVE  35 
Cumulative  mtbur  99b 
TRUE  MTBUR  6096 
BETA  1.2938 
IhETA  1057.0 
C0RR.  C0EFF.  0.9832 


PERI00  54 
HJURS  CUMULATIVE  321898 
SCMEO.  REMS.  CUMULATIVE  0 
FAILURES  CUMULATIVE  53 
CuuULATIV£  MTBUP  1400 
TRUE  MTBUR  6073 
BETA  1.2568 
THETA  1505.3 
C0RR.  COEFF.  0.9872 


PERIOD  72 
HOURS  CUMULATIVE  428122 
SCmEO.  REMS.  CUMULATIVE  0 
FAILURES  CUMULATIVE  70 
CUMULATIVE  MTBUR  1666 
TRUE  MTBUP.  6116 
BETA  1.2316 
ThETA  1798.4 
CORK.  COEFF.  0.9854 


PERIOD  90 
HOURS  CUMULATIVE  5367.79 
SCMEO.  REMS.  CU“U!  ATIVE  0 
FAILURES  CUMULATIVE  88 
CUMULATIVE  MTBUR  1995 
TRUE  HT8UR  6098 


Figure  68,  Sample  Output  From  Component  Fleet  Operation 
Model . 
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subproblem  varies  either  the  dependent  or  independent  vari¬ 
ables.  The  program  then  performs  a  least-squares,  stepwise, 
multiple  regression  on  the  data.  The  output  includes,  among 
other  things,  the  mean  and  standard  deviation  of  each  variable, 
the  multiple  correlation  coefficient,  standard  error  of  esti¬ 
mate,  analysis  of  variance,  and  the  constants  used  in  the 
generated  predictive  equation. 

The  variables  used  were  true  8,  true  9,  observed  6,  observed 
0,  operating  hours,  number  of  failures,  and  the  natural  loga¬ 
rithms  of  each,  thereby  comprising  12  variables.  Sixteen  sub¬ 
problems  were  used  in  order  to  find  the  best  equations  for 
predicting  true  8  and  true  0 . 

The  best  correlations  were  found  in  the  logarithmic  relation¬ 
ships  between  the  variables.  Two  equations  were  generated 
which  it  is  felt  can  be  used  to  predict  true  8,  since  both  had 
a  multiple  correlation  coefficient  above  0.95.  These  equations 
showed  the  log  of  true  8  to  be  a  function  of  the  log  of  ob¬ 
served  6  and  the  log  of  the  number  of  failures,  or  the  log  of 
observed  8  and  the  log  of  total  operating  lv>urs.  Tne  equations 
are  as  follows: 


True  8  =  e 

-0.59796 

obs 

6  1.46985 

,  ..  0.05658 

no.  failures 

-1.41821 

obs 

1.40309 

u  0.08655 

True  8  =  e 

6 

hours 

The  log  of  true  6  was  found  to  be  a  function  of  the  logs  of 
observed  8,  observed  0,  and  number  of  failures.  Although  the 
multiple  correlation  coefficient  at  0.88  was  not  as  high  as 
the  previous  two,  the  standard  error  of  estimate,  0.3465,  di¬ 
vided  by  the  mean  value  of  the  log  of  true  0,  7.95,  yields  an 
acceptable  coefficient  of  variation  of  4.4  percent.  The  re¬ 
sulting  equation  is: 


True 


5.08188  ^ 

0  =  e  obs 


8 


-1.05683 

obs 


0.81260 
0  no . 


failures 


-0.54431 


The  conclusions  to  be  drawn  from  this  analysis  are  as  follows. 
First,  observed  8  has  a  tendency  to  be  greater  than  the  true 
8,  decreasing  and  approaching  true  6  as  operating  hours  or 
sample  size  increase.  Observed  0,  on  the  other  hand,  starts 
out  in  early  observations  as  a  small  fraction  of  true  0,  in¬ 
creasing  with  number  of  failures  in  the  direction  of  true  0. 
These  equations  were  transformed  to  predict  observed  8  and  0 
for  a  given  true  8  and  0. 
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In  summary,  then, one  should  be  wary  when  analyzing  sample  data, 
since  observed  or  measured  3’s  overestimate  the  true  6,  which 
could  lead  to  the  misreading  of  a  constant  failure  rate  as  an 
increasing  failure  rate.  Additionally,  observed  or  measured 
8's  tend  to  underestimate  the  true  0,  which  could  lead  to  the 
imposition  of  a  TBO  at  a  value  less  than  necessary. 

Model  Operation  with  1,200-Hour  TBO 

Although  the  purpose  of  this  section  is  to  develop  equations 
useful  in  estimating  true  values  for  3  and  0  while  operating 
on  condition,  it  was  felt  that  a  TBO  case  should  be  examined 
to  determine  its  effect  on  the  modifying  equations.  Accord¬ 
ingly,  the  baseline  TBO  of  1,200  hours  was  chosen  and  15 
simulation  runs  were  made,  resulting  in  output  of  almost  100 
data  points. 

Generally,  the  results  were  as  expected.  Compared  to  the  on- 
condition  simulation  runs,  operating  with  a  TBO  caused  the 
number  of  failures  generated  to  be  higher,  identical,  and 
lower,  for  3's  of  less  than  1,  1,  and  greater  than  1,  respec¬ 
tively.  0's  calculated  were  higher  when  using  a  TBO  than  when 
operating  on  condition,  holding  all  other  factors  constant. 

3's  were  alternately  higher  or  lower,  depending  on  the  other 
input  parameters,  and  no  clear-cut  generalizations  can  be  made. 

As  was  done  previously  with  the  output  from  the  on-condition 
simulation  runs,  the  data  was  fed  into  a  stepwise  multiple- 
regression  program  to  correlate  the  data  and  generate  the 
modifying  equations. 

The  results  were  basically  the  same,  in  that  observed  3  tended 
to  be  greater  than  true  3,  decreasing  and  approaching  true  3 
as  operating  hours  and  sample  size  increased.  Again,  similar 
to  the  on-condition  results,  observed  0  tended  to  be  less  than 
true  0,  increasing  and  approaching  true  0  as  operating  hours 
and  sample  size  increased.  For  comparison,  the  coefficients 
generated  using  the  two  sets  of  input  data  are: 

Coefficients 

Exponent  Obs  3  Removals  to  Be  Used  in 

On-Condition  -0.58988  1.46279  0.05624  3  Modifying 

Equation 

TBO  -0.81492  1.21914  0.10212 


Coef f icients 

Exponent  Obs  3  Obs  G  Removals  to  Be  Used  in 

On-Condition  5.15163  -1.02614  0.80499  -0.55118  0  Modifying 

Equations 

TBO  4.71191  -0.63505  0.81524  -0.46392 
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An  example  was  chosen  to  compare  the  modifications  that  result 
from  using  the  two  sets  of  equations,  given  that  certain  6's, 
removals,  and  0's  are  observed.  The  results  are  shown  using 
the  equations  developed  from  the  on-condition  simulation  runs 
and  the  TBO  runs : 


Observed 

Modified 

0 

Modified 

0 

0 

e 

Removals 

On-Cond 

TBO 

On-Cond 

TBO 

3,500 

200 

0.27 

0.33 

13,514 

11,461 

0.75 

3,500 

200 

0.49 

0.54 

8,917 

8,858 

1.0 

3,500 

200 

0.75 

0.76 

6,636 

7,377 

1.5 

3,500 

200 

1.35 

1.25 

4,376 

5,704 

2.0 

3,500 

200 

2.06 

1.77 

3,257 

4,750 

3.0 

200 

3.73 

2.90 

2,152 

3,673 

In  order  to  develop  a  valid  modifying  equation  for  changing 
sample  estimates  to  fleet  estimates,  simulation  runs  for  a 
variety  of  TBO's  would  be  necessary,  meaning  that  4  to  5  times 
as  many  runs  would  have  to  be  made  as  have  already  been  com¬ 
pleted.  This  was  not  the  intent  of  this  section,  although 
from  this  TBO  case  it  appears  that  differences  are  not  major. 

It  is  felt  that  no  further  conclusions  in  this  area  can  be 
made. 

Justification  of  Use  of  Least-Square  Fit  for  0  and  e 

John  H.  K.  Kao  of  Cornell  University  (and  more  recently  NYU)  in 
his  paper,  COMPUTER  METHODS  FOR  ESTIMATING  WEIBULL  PARAMETERS 
IN  RELIABILITY  STUDIES 1  s,  identified  four  methods  of  estimating 
the  parameters  of  the  Weibull  distribution: 


1.  Method  of  least-squares  on  transformed  data 

2.  Method  of  maximum  likelihood  for  ungrouped  data 

3.  Method  of  maximum  likelihood  for  grouped  data 

4.  Method  of  minimized  X-squares  for  grouped  data 

Of  these  four  methods  only  the  first  two  are  truly  applicable 
to  transmission  reliability  analyses  because  they  are  independ¬ 
ent  of  data  grouping.  Although  the  maximum  likelihood  estimate 
gives  the  theoretically  more  correct  estimates  of  the  Weibull 
parameters,  it  requires  solution  of  the  following  simultaneous 
equations*  via  trial-and-error  methods. 


*A  derivation  of  the  maximum  likelihood  equations  for  a  3-param 
eter  Weibull  distribution  can  be  found  in  MAXIMUM  LIKELIHOOD 
ESTIMATION  OF  THE  PARAMETERS  OF  GAMMA  AND  WEIBULL  POPULATIONS 
FROM  COMPLETE  AND  FROM  CENSORED  SAMPLES,  Harter,  H.  Leon,  and 
Moore,  Albert  H.,  Technometrics,  Volume  7,  No.  4.  November 
1965. 
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The  equations  to  be  solved  are: 


l=1  t?  In  ti  +  (n-r)  t£  In  (tr) 


+  l  ln  fci 
i=l 


As  observed  by  Kaols,  the  results  of  the  MLE  method  are,  in 
general,  not  too  different  from  the  estimates  developed  by 
the  least-squares  method. 

Thus,  the  least-squares  method  has  been  used  in  this  analysis 
to  estimate  the  Weibull  distribution  parameters  on  the  basis 
of  acceptable  accuracy  and  ease  of  application. 
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APPENDIX  VI 

SAMPLE  FAILURE  MODE  EFFECTS  AND  CRITICALITY  ANALYSES 


INTRODUCTION 

This  FMECA*  was  prepared  by  the  Bertea  Corporation,  Irvine, 
California,  to  fulfill  the  requirements  of  The  Boeing  Company 
Data  Item  Sheet  No.  R0050A.  The  information  is  applicable  to 
the  end  item  of  Swashplate  Driver  Actuator,  Boeing  Specifica¬ 
tion  Number  S301-10035.  It  is  considered  an  excellent  example 
of  the  manner  in  which  an  FMECA  should  be  performed. 


COMPONENT  DESCRIPTION 

The  component  described  herein  is  the  Bertea-furni shed  equip¬ 
ment  for  the  flight  control  system  of  the  Model  347  helicopter 
as  modified  for  fly-by-wire. 

The  Swashplate  Driver  Actuator  (SDA)  is  a  dual  failure-operate, 
triple-channel  (ram  force)  unit  (see  Figure  71) .  Each  chan¬ 
nel  is  operated  as  a  separate  conventional  electrohydraulic 
actuator  except  for  an  electrically  selected  mode  of  operation. 

The  SDA  utilizes  an  active/on-line  redundancy  concept  wherein 
only  one  channel  is  actually  controlling  the  actuator  output. 
The  controlling  channel  is  fully  active  and  is  at  high-force 
gain,,  Redundant  channels,  although  engaged  or  on-line,  are 
incapable  oc  carrying  any  load.  This  is  accomplished  by  clos¬ 
ing  a  high-gain  lagged  load  pressure  (AP)  feedback  loop  around 
the  actuator  electrically  via  the  e1 -ctrohydraulic  servovalve. 

In  the  event  of  failure  of  the  active  channel,  its  associated 
servovalve  is  disengaged  and  the  channel  is  isolated  from  the 
system  and  bypassed.  Simultaneously,  the  high-gain  pressure 
feedback  signal  is  switched  out  from  one  on-line  channel,  making 
that  channel  the  controlling  channel.  Failure  of  an  on-line 
channel  results  in  disengagement  of  that  channel. 

Authority  of  the  AP  feedback  is  intentionally  limited  such  that 
the  on-line  channels  oppose  a  failed  active  channel  tnd/or 
load-share  as  soon  as  the  limit  is  exceeded. 

Each  channel  of  the  SDA  provides  dual  capability  for  disengage¬ 
ment  and  bypass.  Disengagement  is  accomplished  by  use  of  two 
in-series  solenoid  valves  and  bypass  by  two  independent  bypass 
features,  one  in  the  electrohydraulic  servovalve  and  one  in  the 
AP  sensor/bypass  valve. 

*This  FMECA  has  been  extracted  from  Bertea  Document  228800, 

Rev.  A,  15  September  1972. 
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Three  failure-monitoring  signals  from  each  channel  are  pro¬ 
vided  for  use  by  the  DELS  control  unit.  The  three  sources  of 
these  signals  are  one  Linear  Variable  Differential  Transducer 
(LVDT)  monitoring  actuator  channel  piston  position,  one  LVDT 
monitoring  the  electrohydraulic  servovalve  second-stage  spool 
position,  and  one  LVDT  monitoring  t;-2  AP/bypass-valve 
operation. 

Mechanical  attachment  of  all  three  channels  (ram  force)  is  ac¬ 
complished  w!th  a  single  (common)  tie  point  at  the  swashplate 
and  at  structure. 


FAILURE  MODE  EFFECTS  AND  CRITICALITY  ANALYSES 


The  failure  mode  effects  analysis  and  the  criticality  analysis 
are  presented  on  separate  worksheets. 

The  various  possible  failure  modes  of  each  component  are  iden¬ 
tified  (see  Table  XXXVI) . 

Those  components  having  critical  failure  modes  resulting  in 
hazard  classification  of  III  and  IV  are  analyzed  .relative  to 
criticality. 

Analysis  Assumptions 

1.  All  electrical  inputs  from  aircraft  systems  are  received 
at  the  SDA  interface  in  a  normal  manner. 

2.  The  hydraulic  fluid  supply  from  aircraft  systems  I,  II, 
and  III  are  received  at  the  SDA  interface  in  a  normal 
manner . 

FMECA  Definitions 


Channel 


A  separate,  conventional,  force  output,  electrohydraulic 
actuator  section  consisting  of  2  parallel  piston/ 
cylinder  arrangements,  2  separate  manifold  assemblies, 

2  intermanifold  transfer  tubes,  2  solenoid  control  valves 
in  series,  1  electrohydraulic  servovalve,  1  AP/bypass 
valve,  1  LVDT  for  piston  position,  1  LVDT  for  servovalve 
spool  position,  and  1  LVDT  for  AP/sensor  bypass-valve 
monitoring . 

Active  Stage  of  Operation 

That  period  of  time  when  a  channel  is  actually  controlling 
the  actuator  output. 


228 


TABLE  XXXVI.  FAILURE  MODE  EFFECTS  ANALYSIS 


TABLE  XXXVI  -  Continued 
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TABLE  XXXVI  -  Continued 
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TABLE  XXXVI  -  Continued 


On-Line  Stage  of  Operation 

That  period  of  time  when  a  channel  is  engaged  electrically 
and  hydraulically,  but  is  incapable  of  carrying  any  load. 

Minor  Leakage 

That  amount  of  leakage  over  and  above  component  specifica¬ 
tion  allowable  leakage  but  component  function  is  not  lost; 
the  result  is  degraded  component  performance. 

Major  Leakage 

That  amount  of  leakage  over  and  above  component  specifica¬ 
tion  allowable  leakage  from  which  component  function  is 
lost. 

Criticality  Analysis  Reliability  Data  Source 

The  following  data  sources  were  used  to  determine  failure 
rates.  These  sources  were  supplemented  with  good  engineering 
judgment: 

1.  Bertea  experience  with  similar  equipment  in  use  on  mili¬ 
tary  flight  hardware  (P-3,  C-5A,  and  F-4) . 

2.  Bertea  experience  with  similar  equipment  in  use  on  com¬ 
mercial  flight  hardware,  plus  airline  component  removal 
data  (707,  727,  737,  747,  DC-8,  DC-9,  DC-10,  L-1011,  and 
Gulfstream  II) . 

3.  MIL-HDBK-217A,  Reliability  Stress  and  Failure  Rate  Data 
for  Electronic  Equipment. 

Analysis  Summary 

Failure  Mode  Effects  Analysis  (Table  XXXVI) 

Significant  findings  of  the  failure  mode  effects  analysis 
may  be  summarized  as  follows: 

1.  An  open  load  path  at  either  actuator  attachment 
fitting  or  a  jammed  piston  will  result  in  loss  of 
aircraft  (flight  safety.  Class  IV) . 

2.  A  cracked  actuator  attachment  fitting  results  in  a 
mission  abort,  Class  III. 

3.  Major  external  leakage  of  a  channel  component,  a 
clogged  passage,  or  structural  failure  of  components 
resulting  in  major  leakage  will  result  in  eventual 
system  fluid  depletion  with  loss  of  one  common  channel 
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at  each  swashplate  control  position  (mission  abort 
Class  II) . 

4.  All  other  failure  modes  identified  are  classified  as 
I  or  II  and  require  mission  abort  or  maintenance 
action. 

Criticality  Analysis  (Table  XXXVII) 

Criticality  ranking  of  the  several  components  exhibiting 

Class  III  and  IV  effects  follows,  with  the  most  critical 

listed  first. 

1.  Actuator  attachment  fitting  experiencing  cracks  or 
open- load-path  modes. 

2.  Piston/cylinder  combination  in  a  jam  mode. 
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APPENDIX  VII 

DEVELOPMENT  OF  MATHEMATICAL  MODELS 


RELATIONSHIP  OF  Biq  LIFE  TO  HAZARD  FUNCTION 


A  computer  program  has  been  developed  to  calculate  hazard  rate 
as  a  function  of  Big  and  3.  This  program  is  primarily  for  ap¬ 
plication  when  developing  modal  hazard  functions  for  bearings. 


A  complete  listing  and  documentation  of  this  program  are  con¬ 
tained  in  the  Program  Documentation  Volume  of  this  report. 

A  derivation  of  the  equation  for  hazard  function  used  in  this 
program  is  contained  in  the  following  paragraph: 


Reliability  =  R 
In  R 
-In  R 
In  (-In  R) 

In  (-In  R) 

6 


e  -(TIME/0)3 

1  (t/0) 3 
(t/0)3 

In  ((t/0)3)  =  3  In  (t/0) 
In  (t/0) 


Let  R  equal  0.90,  which  means  that  R  (the  cumulative  probabil¬ 
ity  of  failure)  is  equal  to  0.10. 

By  definition,  the  time  at  which  R  equals  0.10  is  the  component 
B10  life. 

Then,  ia  .(rln.i°.._90)I  „  ln  (B  /6) 

P  XU 

ln(- (r0. 10536) )  _  ln  (b10/8) 


-2,25 

8 

In  B10  - 

ln0 

2.25 

8 

ln0  -  ln 

B10 

2.25 

6  + 

In  B10  = 

ln0 

e2.25/S 

+  In  B^o 

=  e 

ln0 
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RELATIONSHIP  OF  B10  TO  MTBF 

Regardless  of  the  distribution  {f  (t))  of  component  time  to 
failure,  the  expected  time  to  failure  or  mean  time  between 
failures  (MTBF)  can  be  calculated  using  the  equation 


MTBF  =  /  t  •  f(t)  dt 


For  the  Weibull  distribution, 


F ( t)  =  e/9  (^)6"1  e~(t/6)6  dt  when  0<t<» 

F(t)  =0  elsewhere 
Thus  for  the  Weibull, 


MTBF  =  /  t  •  |  (|) 


(t/e) 


(12) 


To  integrate  the  right  side  of  this  equality, 
let  W  =  (t/0)  6 
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Then 


(13) 


t  =  6  .  wj 

p 

and  dw  =  (-1*.)  t3-1  dt  (14) 

0  p 

Substitution  of  equations  13  and  14  into  equation  12  yields 

to 

MTBF  =0/  wi  e“w  dw  (15) 

o  ^ 

where  the  integrand  is  a  form  of  the  gamma  function  whose 
values  are  readily  available  in  standard  mathematical  tables. 

Thus,  the  final  result  can  be  expressed  as 

MTBF  =  0  •  r  (i  +  1)  (16) 

Thus,  MTBF  =  e2*25^6  •  B1q  •  r  (i  +  1) 

Although  the  above  derivation  and  resulting  equation  16  are 
theoretically  correct,  a  word  of  caution  regarding  their  ap¬ 
plication  is  in  order. 

The  gamma  function  solution  to  equation  15  requires  that  the 
distribution  of  time  to  failures  be  infinite.  Thus  if  a  com¬ 
ponent  has  a  retirement  life,  TBO,  or  some  maximum  intended 
life  cycle  (all  of  which  will  be  called  TBO) ,  the  utilization 
of  equation  16  is  not  theoretically  correct. 

The  use  of  equation  16  where  the  distribution  of  times  to  fail¬ 
ure  is  finite  will  yield  the  following: 

1.  Overestimates  of  MTBF  for  0  values  greater  than  1. 

2.  Underestimates  of  MTBF  for  0  values  less  than  1. 

3.  No  error  for  0  values  equal  to  1. 

The  amount  of  bias  incurred  for  0  values  not  equal  to  1  is  a 
function  of  the  relationship  between  0  and  TBO. 

For  0  values  greater  than  1,  if  TBO  is  large  in  comparison  to 
e,  very  little  error  will  be  encountered  through  use  of  equa¬ 
tion  16.  As  a  working  rule,  TBO  values  of  at  least  6  times  0 
will  result  in  an  acceptable  error  in  MTBF. 

For  0  values  less  than  1,  TBO  should  be  at  least  10  times  6  in 
order  to  use  equation  16  with  acceptable  accuracy. 
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A  program  has  been  written  to  solve  equation  16.  Complete 
documentation  of  this  program  is  contained  in  the  Program  Docu¬ 
mentation  Volume  of  this  report.  This  program  is  intended  for 
use  only  in  those  cases  where  acceptable  accuracy  can  be  ex¬ 
pected  due  to  the  0  and  TBO  values  of  the  component. 


For  those  cases  where  the  gamma  function  solution  will  not 
yield  acceptable  accuracy,  the  following  approximation  of  MTBF 
can  be  employed:  /  TB0 

t  .  f(t)dt] 


MTBF  = 


/  TI 

(< 


tj  +  ^L-R  (TBO)^(TBO) 


R (TBO) 


(17) 


where  for  the  Keibull  distribution 


-(TBO/0)6 

R  (TBO)  =  1  -e 


The  equation  17  for  a  Weibull  distribution  becomes 


/TBO 

MTBF  =  i  J  t 
'  o 


B 

0 

+ 


t  D 

•  (q-)  •  e  dt 

e-(TBO/0) $ 


(l-e~ (TBO/6) 6 


(TBO) 


/TBO, B 
V  0  ’ 

(18) 


Equation  18  for  8  values  not  equal  to  1  cannot  be  solved 
directly;  thus,  a  numerical  integration  program  is  employed 
for  the  solution  of  aquation  18.  This  is  the  same  program 
used  to  solve  equation  12.  The  only  point  to  remember  is  that 
in  using  che  program  the  resulting  MTBF  must  be  modified  to 
handle  the  hours  on  unfailed  components. 


COMBINATION  OF  MODAL  HAZARD  FUNCTIONS  INTO  AN  ASSEMBLY 
HAZARD  FUNCTION 

A  FORTRAN  program  has  been  written  to  combine  modal  hazard 
functions  into  an  assembly  hazard  function.  Complete  documen¬ 
tation  of  this  program  is  contained  in  the  Program  Documenta¬ 
tion  Volume  of  this  report. 

The  mathema'  ical  model  that  provides  the  oasis  for  this  com¬ 
puter  program  is  developed  in  the  following  paragraphs. 
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As  defined  earlier ,  the  hazard  function  can  be  expressed  as 


where  f(t)  =  the  probability  density  function 
and  F ( t )  =  cumulative  probability  of  failure. 

Foi  .1  Weibull  distribution. 


f(t) 
F  ( t) 


It  should  be  noted  here  that  another  notation  previously  used 
in  this  report  for  cumulative  probabilitv  of  failure  is 

-  -  (— )  e 

R  ( t)  =  1  -  e  0  =  1  -  R  ( t) 


where  R(t)  is  equal  to  unreliability  and  R(t)  is  equal  to 
reliability. 

For  a  transmission  composed  of  M  components  each  having 
failure  modes  such  that 

M 


the  probability  that  the  transmission  will  operate  success¬ 
fully  to  time  t  is  the  same  as  the  probability  that  all  parts 
of  the  transmission  will  operate  successfully  to  time  t. 

Thus,  to  calculate  the  reliability  of  the  transmission  it  is 
necessary  to  consider  the  reliability  of  each  of  the  components 
of  the  transmission. 

With  the  assumption  that  the  failure  modes  of  each  part  can  be 
described  by  a  Weibull  distribution  of  the  form 

Ri'L  =  e  9i,L 

where  R^^  the  reliability  of  the  i^h  component  for  the  L*-*1 
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failure  mode  of  that  component,  and  that  all  parts  of  the 
transmission  are  nonredundant,  then  the  reliability  of  the 
transmission  Rx(t)  can  be  described  as 


R 


M  Ji 

x<t>  -  TT  71  Ri,L(t) 
1=1  L=1 


Thus, 


M  Ji  t  ei,L 

nrr  e-^) 

i=l  L=1 


or 


Rx(t) 


=  e 


M  Ji  .  6i,L 

l  l 

-  i=l  L=1  ai,L 


Similarly,  the  joint  probability  density  function  fx(t),  the 
probability  density  function  for  failure  of  any  transmission 
component  in  any  mode,  can  be  demonstrated  to  be  of  the  form 


fx(t) 


Ji 


I 

L=1 


Thus,  the  hazard  function  of  the  assembly  Hx(t)  can  be  evalu¬ 
ated  using  the  equation 


Hx(t) 


Rx<t> 

1  -  Rx(t) 


This  is 
structs 


the  equation  used  in  the  computer  program  which  con- 
the  assembly  hazard  functions. 
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APPENDIX  VIII 
DATA  REDUCTION 


INTRODUCTION 


The  purpose  of  this  section  is  to  explain  why  historical 
transmission  failure  data  has  been  collected  and  how  it  can  be 
used,  and  to  present  the  tables  which  comprise  the  reduced 
data. 


SUMMARY 

The  development  of  hazard  functions  from  field  or  test  data 
facilitates  the  transmission  failure  mode  analyses  intrinsic 
to  the  determination  of  on-condition  potential.  In  the  case 
of  existing  hardware,  the  decision  of  whether  or  not  to  go 
on-condition  is  less  difficult  due  to  the  existence  of  failure 
data  and  becomes  increasingly  simpler  as  the  amount  of 
reliability  data  on  that  gearbox  increases. 


Unfortunately,  one  rarely  has  at  his  disposal  occurrence  rates 
and  hazard  functions  for  transmission  failure  modes  during  the 
design  stage.  The  designer  must  then  rely  on  the  past  perform¬ 
ance  of  similar  components,  or  use  generic  failure  rates  (for 
example,  bearing  failure  rates) .  For  this  reason  failure  data 
was  analyzed  on  the  following  transmissions: 


1. 


2. 


3. 


4. 


5. 


6. 


7. 


CH-47  forward,  part  no.  114D1200 
CH-47  aft,  part  no.  114D2200 
CH-47  combining,  part  no.  114D5200 
CH-47  engine,  part  no.  114D6200 
CH-46  forward,  part  no.  A07D1202 
CH-46  aft,  part  no.  A02D2013 
CH-46  mix  box,  part  no.  107D2004 


8.  H-3  main,  part  no.  S6135-20600 

9.  UH-1  main,  part  no.  204-040-009 


The  analysis  of  this  data  consists  of  generic  failure  mode 
distributions,  failure  mode  distributions  unique  to  certain 
aircraft  and  certain  transmissions,  and  the  limits  on  the  8 
parameter  of  the  hazard  function  for  CH-47C  transmission 
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failure  modes.  This  section  provides  the  maximum  representa¬ 
tion  of  available  data  to  serve  as  a  basis  for  failure  mode 
analyses  on  new  designs. 

APPLICATION  OF  THE  DATA 

The  primary  function  of  the  data  presented  here  is  to  provide 
a  basis  for  construction  of  an  assembly  hazard  function  when 
historical  data  from  the  assembly  in  question  does  not  exist. 

There  are  two  situations  in  which  one  can  construct  a  hazard 
function  using  the  techniques  associated  with  the  Weibull 
distribution: 

1.  The  case  of  an  operational  transmission  with  a  field 
experience  record. 

2.  The  case  of  a  transmission  without  operational  data,  but 
similar  to  another  transmission  which  the  contractor  has 
developed  for  which  there  is  data. 

Two  other  situations  which  must  be  handled  differently  and 
which  use  the  data  in  this  appendix  are: 

1.  The  case  of  a  transmission  being  designed,  which  has  no 
data  base  existing,  but  which  is  similar  to  one  of  the  nine 
transmissions  whose  data  is  presented  here. 

2.  The  case  of  a  transmission  being  designed,  which  has  no 
base  existing,  is  not  similar  to  any  of  the  nine  trans¬ 
missions  whose  data  is  presented  here,  but  is  composed  of 
parts  for  which  generic  failure  data  is  present  in  this 
appendix. 

Hazard  functions  for  these  two  cases  should  be  constructed 
following  this  procedure: 

1.  Determine  the  percentage  of  failures  traditionally  caused 
by  the  mode  being  considered.  To  illustrate  the  procedure, 
the  pitting  and  spalling  of  bearings  is  used  as  an  example. 
This  has  historically  caused  15.55  percent  of  transmission 
failures. 

2.  Convert  this  percentage  to  a  failure  rate,  based  on  the 

total  transmission  assembly  requirement.  In  our  example, 
if  the  assembly  requirement  were  for  a  1,500-hour  MTBF, 
then  the  failure  rate  for  bearings  would  be  1,500  or  1 
failure  per  9,646  hours.  0.1555 
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3.  Multiply  this  figure  by  the  number  of  bearings  in  the 
transmission  design.  If  there  were  10,  then  the  failure 
rate  would  be  1  failure  per  96,460  hours. 

4.  Determine  the  g  parameter  expected  for  bearings.  In  this 
case,  a  g  of  1.2  is  expected. 

5.  Calculate  the  e  parameter,  based  on  g  and  MTBF.  You  now 
have  the  hazard  function  for  pitting/spalling  bearings, 
for  the  transmission  being  designed. 

6.  Repeat  steps  1  through  5  for  the  rest  of  the  expected 
failure  modes  in  the  transmission  design,  developing 
hazard  functions  for  all  modes. 

7.  Calculate  a  total  assembly  hazard  function  from  the  modal 
hazard  functions. 

At  this  point  other  analyses  are  done  to  determine  the  cost- 
effectiveness  or  establish  the  optimum  TBO  of  the  newly 
designed  transmission.  The  above  procedure  shows  how  to  use 
the  data  presented  in  this  section.  Having  calculated  the 
hazard  functions,  one  then  decides  if  g  is  unacceptably  high 
and/or  0  is  unacceptably  low,  leaving  the  options  of  redesign, 
testing,  or  installing  appropriate  diagnostic  systems. 

HELICOPTER  TRANSMISSION  FAILURE  DATA 

The  failure  data  presented  here  was  compiled  from  four  sources 
the  CH-46  and  CH-47  data  consists  of  transmission  overhaul 
reports;  the  CH-3  data  was  derived  from  report  SER  50547, 

STUDY  OF  HELICOPTER  TRANSMISSION  SYSTEMS  DEVELOPMENT  TESTING, 
Final  Report,  dated  5  June  1968;  the  UH-1  data  was  reduced 
from  USAAVLABS  Technical  Report  70-66,  MODE  OF  FAILURE 
INVESTIGATIONS  OF  HELICOPTER  TRANSMISSIONS,  dated  January  1971 
The  compilation  consists  of  six  tables; 

Table  XXXVIII  -  This  is  based  on  data  from  all  nine  transmis¬ 
sions  and  presents  percentages  of  failures  occurring  by  modes. 
It  is  a  summary  of  Table  XXXIX. 

Table  XXXIX  -  This  table  shows  the  failure  mode  distribution 
of  transmissions  by  aircraft  type.  The  CH-47  modes  have  been 
grouped  to  be  compatible  with  the  others  to  facilitate  com¬ 
parison.  For  this  reason,  the  categories  high  time, 
manufacturing  errors,  and  other  not  not  included. 

Table  XL  -  Table  XL  consists  of  the  CH-47  failure  mode  dis¬ 
tribution  by  type  of  transmission.  This  data  is  summarized 
on  Table  XXXIX. 
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Table  XLI  -  This  table  comprises  the  number  of  failures  and 
the  percentage  by  component  class  for  each  transmission  in 
the  CH-47. 

Table  XLII  -  This  is  composed  of  the  CH-46  failure  mode  dis- 
tribution  by  type  of  transmission.  The  table  is  summarized 
in  Table  XXXIX. 

Table  XLIII  -  This  table  presents  the  8  parameters  by  failure 
mode  by  component  class  for  the  CH-47C  transmissions.  The 
minimum  8  represents  the  lowest  calculated,  the  maximum  8  is 
the  highest  calculated,  and  the  expected  8  shows  the  average 
of  all  calculated. 

It  should  be  noted  that  the  percentages  identified  in  Tables 
XXXVIII  through  XLII  do  not  represent  the  percentage  or  rate 
at  which  tnese  modes  generate  unscheduled  removal.  Rather, 
they  are  representative  of  the  manner  in  which  failures  are 
distributed  over  various  modes,  some  or  all  of  which  compete 
to  cause  an  unscheduled  removal.  Thus,  in  using  this  data, 
it  is  necessary  that  the  failure-warning  and  inspection  system 
unique  to  a  given  design  be  evaluated  to  determine  which  (if 
any)  modes  would  be  virtually  or  partially  undetectable.  The 
existence  of  undetectable  failures  would  necessitate  modifica¬ 
tion  of  the  percentages  shown  in  Tables  XXXVIII  through  XLII 
to  modify  the  percentages  into  cause-of-removal  rates. 
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TABLE  XLI .  CH-47  FAILURE  DISTRIBUTION  BY  COMPONENT 

CLASS  AND  TRANSMISSION  TYPE 


.-506  99.26  911  100.21  3,460  99.97  3,287  99.91  10,164  99.97 


TABLE  XLII.  CH-46  FAILURE  MODE  DISTRIBUTION  BY 
COMPONENT  CLASS 


NOTE:  All  values  are  expressed  in  percent. 


TABLE  XLIII .  LIMITS  ON  8  FOR  VARIOUS  FAILURE  MODES 
ON  CH-47C  TRANSMISSIONS 


Component  Failure 

Minimum 

Class  Mode 

Samp  Mod 

Bearings  All  modes 

0.6  0.3 

Spalled,  pitted 

0.9  0.6 

Scuffed,  scored,  frosted 

0.6  0.4 

Fretted,  worn 

0.4  0.2 

Gouged,  dented 

0.4  0.2 

Gears  All  modes 

0.8  0.6 

Spalled,  pitted 

0.8  0.5 

Cracked 

0.4  0.2 

Scuffed,  scored,  frosted 

0.7  0.4 

Fretted,  worn 

0.8  0.4 

Gouged,  dented 

0.7  0.4 

Lube  System  All  modes 

0.9  0.6 

Wor~. 

0.7  0.4 

Scuffed,  scored,  frosted 

0.8  0.5 

Gouged,  dented 

0.7  0.4 

Cracked,  broken 

1.0  0.6 

Retention  and  All  modes 

0.6  0.4 

Mounting  Cracked,  broken 

0.5  0.3 

Hardware  Pitted,  spalled 

0.8  0.5 

Worn 

l.P  0.7 

Gouged,  dented 

0.7  0.4 

Scuffed,  scored,  frosted 

0.6  0.3 

Nonrotating  All  modes 

0.8  0.5 

Structure  Pitted,  spalled 

1.0  0.7 

Worn 

0.7  0.4 

Gouged,  dented 

0.4  0.2 

Cracked 

0.8  0.4 

Scuffed,  scored 

0.8  0.4 

Shafts  All  modes 

0.5  0.3 

Scuffed,  scored 

0.5  0.2 

Pitted,  spalled 

0.8  0.4 

Worn 

0.5  0.2 

Cracked 

0.4  0.2 

Gouged,  dented 

0.3  0.1 

Clutches*  All  modes 

0.8  0.5 

Worn 

0.9  0.5 

Cracked,  broken 

1.0  0.7 

*  Clutch  data  based  on  2  gearboxes 

Samp 

Mod 

Expected 


Samp  Mod 


1.0  0.7 

1.5  1.3 

1.2  0.9 

2.6  2.6 

1.5  1.2 

1.3  1.0 

2.2  2.0 


1.0  0.7 

1.1  0.8 
1.2  1.0 
0.9  0.6 

1.1  0.8 


1.2  0.9 

0.8  0.5 

1.1  0.8 

1.1  0.7 

0.9  0.6 

1.0  0.7 


.3 


0.6  0.3 

1.8  1.4 

0.8  0.4 

0.9  0.7 

0.9  0.6 


2.3 


LEGEND 


Modified  to  total 
fleet  value 
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APPENDIX  IX 

DEVELOPMENT  OF  ELEMENTAL  HAZARD  FUNCTIONS 


The  purpose  of  this  section  is  to  provide  hazard  function 
plots  on  all  CH-47  transmission  parts  for  which  sufficient 
data  was  available  (Figures  72  through  78) . 

Source  of  the  data  was  Boeing  Vertol  overhaul  records.  The  S 
and  0  parameters  were  calculated  by  the  method  of  least  squares 
on  transformed  data;  the  hazard  rate  was  then  calculated  for 
specific  points  in  time  using  the  equation  for  hazard  function. 
This  was  done  for  each  transmission,  for  various  transmission 
parts  and  modes  of  failure,  and  the  results  were  plotted. 
Summaries  by  transmission  of  all  failures  of  certain  parts  are 
also  presented  here. 

These  plots  represent  sample  hazard  functions?  that  is,  they 
have  been  calculated  based  on  observed  data  and  should  be  mod¬ 
ified  into  fleet  hazard  functions  with  the  equation  developed 
in  Appendix  V  before  they  are  used. 

The  modification  of  the  6  parameter  of  these  sample  estimates 
into  fleet  estimates  is  portrayed  in  Table  XLIII  of  Appendix 
VIII,  which  summarizes  the  limits  on  0  by  transmission  part 
for  various  failure  modes. 
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igure  73.  Hazard  Function  Plots  for  Transmission  Gears. 
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igure  77.  Hazard  Function  Plots 


